vciy

CVEs we hold for Icegram

Records whose assigning authority named Icegram as the affected vendor. Newest identifiers first, capped at 200.

CVE-2026-81290WordPress Email Subscribers & Newsletters plugin <= 5.9.33 - Cross Site Scripting (XSS) vulnerabilityIcegram Email Subscribers & Newsletters
CVE-2026-1651Email Subscribers & Newsletters <= 5.9.16 - Authenticated (Administrator+) SQL Injection via 'workflow_ids' Parametericegram Email Subscribers & Newsletters – Email Marketing…
CVE-2026-16087Icegram Engage <= 3.1.42 - Authenticated (Contributor+) Second-Order SQL Injection via 'messages[][id]' ParameterIcegram Engage – Popups, Optins, CTAs & Lead Generation
CVE-2026-15951Icegram Mailer <= 1.0.12 - Authenticated (Administrator+) SQL Injection via 'fields' ParameterIcegram Mailer – Reliable Email Deliverability, No-code…
CVE-2026-12757Email Subscribers & Newsletters <= 5.9.27 - Unauthenticated Arbitrary Shortcode Execution via Subscriber Name Fieldicegram Email Subscribers & Newsletters – Email Marketing…
CVE-2026-11592Email Subscribers & Newsletters <= 5.9.27 - Missing Authorization to Authenticated (Contributor+) Settings Modification…icegram Email Subscribers & Newsletters – Email Marketing…
CVE-2025-68507WordPress Icegram plugin <= 3.1.35 - Broken Access Control vulnerabilityIcegram
CVE-2025-68038WordPress Icegram Express Pro plugin < 5.9.14 - PHP Object Injection vulnerabilityIcegram Express Pro
CVE-2025-66055WordPress Email Subscribers & Newsletters plugin <= 5.9.10 - PHP Object Injection vulnerabilityIcegram Email Subscribers & Newsletters
CVE-2025-49917WordPress Icegram Express Pro plugin <= 5.9.5 - Server Side Request Forgery (SSRF) vulnerabilityIcegram Express Pro
CVE-2025-47527WordPress Icegram Collect – Easy Form, Lead Collection and Subscription plugin <= 1.3.18 - Broken Access Control…Icegram Collect
CVE-2025-24542WordPress Icegram Engage plugin <= 3.1.31 - Cross Site Scripting (XSS) vulnerabilityIcegram
CVE-2025-15692Icegram Express < 5.8.6 - Admin+ Stored XSSUnknown Icegram Express
CVE-2025-12349Email Subscribers & Newsletters <= 5.9.10 - Missing Authentication to Unauthenticated Mailing Queue Triggericegram Email Subscribers & Newsletters – Email Marketing…
CVE-2025-12348Email Subscribers & Newsletters <= 5.9.10 - Missing Authentication to Unauthenticated Action Scheduler Task Executionicegram Email Subscribers & Newsletters – Email Marketing…
CVE-2025-0671Email Subscribers < 5.7.50 - Admin+ Stored XSS in TemplateUnknown Icegram Express
CVE-2024-8771Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.34 -…icegram Email Subscribers & Newsletters – Email Marketing…
CVE-2024-8254Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.34 -…icegram Email Subscribers & Newsletters – Email Marketing…
CVE-2024-6172Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.25 -…icegram Email Subscribers & Newsletters – Email Marketing…
CVE-2024-5756Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.23 - Unauthenticated SQL…icegram Email Subscribers & Newsletters – Email Marketing…
CVE-2024-5703Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.26 - Missing Authorizationicegram Email Subscribers & Newsletters – Email Marketing…
CVE-2024-4845Icegram Express <= 5.7.22 - Authenticated (Subscriber+) SQL Injection Vulnerability via options[list_id]icegram Email Subscribers & Newsletters – Email Marketing…
CVE-2024-43344WordPress Icegram Engage – Ultimate WP Popup Builder, Lead Generation, Optins, and CTA plugin <= 3.1.25 - Cross Site…Icegram
CVE-2024-43273WordPress Icegram Collect plugin <= 1.3.14 - Broken Access Control vulnerabilityIcegram Collect
CVE-2024-43272WordPress Icegram Engage plugin <= 3.1.24 - Unauthenticated Unpublished Campaign Viewer vulnerabilityIcegram
CVE-2024-4295Email Subscribers by Icegram Express <= 5.7.20 - Unauthenticated SQL Injection via hashicegram Email Subscribers & Newsletters – Email Marketing…
CVE-2024-4010Email Subscribers by Icegram Express <= 5.7.19 - Missing Authorization in handle_ajax_requesticegram Email Subscribers & Newsletters – Email Marketing…
CVE-2024-39625WordPress Icegram Engage plugin <= 3.1.24 - Unauthenticated Message Duplication VulnerabilityIcegram
CVE-2024-37252WordPress Email Subscribers by Icegram Express plugin <= 5.7.25 - SQL Injection vulnerabilityIcegram Email Subscribers & Newsletters
CVE-2024-3626Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.17 -…icegram Email Subscribers & Newsletters – Email Marketing…
CVE-2024-2876Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.14 - Unauthenticated SQL…icegram Email Subscribers & Newsletters – Email Marketing…
CVE-2024-2656Icegram Express <= 5.7.14 - Authenticated (Administrator+) Cross-Site Scripting via CSV importicegram Email Subscribers & Newsletters – Email Marketing…
CVE-2024-22300WordPress Icegram Express plugin <= 5.7.11 - Reflected Cross Site Scripting (XSS) vulnerabilityIcegram Email Subscribers & Newsletters
CVE-2024-21748WordPress Icegram Engage plugin <= 3.1.21 - Broken Access Control vulnerabilityIcegram
CVE-2024-13486Icegram Engage < 3.1.32 - Admin+ Stored XSSUnknown Icegram Engage
CVE-2024-13482Icegram Engage < 3.1.32 - Admin+ Stored XSSUnknown Icegram Engage
CVE-2024-12302Icegram Engage < 3.1.32 - Author+ Stored XSSUnknown Icegram Engage
CVE-2024-11924Email Subscribers < 5.7.52 - Admin+ Stored XSSUnknown Icegram Express formerly known as Email Subscribers
CVE-2023-5414Icegram Express <= 5.6.23 - Authenticated (Administrator+) Directory Traversal to Arbitrary File Readicegram Email Subscribers & Newsletters – Email Marketing…
CVE-2023-52119WordPress Icegram Plugin <= 3.1.18 is vulnerable to Cross Site Request Forgery (CSRF)Icegram Engage – WordPress Lead Generation, Popup Builder…
CVE-2023-51532WordPress Icegram Plugin <= 3.1.19 is vulnerable to Cross Site Scripting (XSS)Icegram Engage – WordPress Lead Generation, Popup Builder…
CVE-2023-25024WordPress Icegram Collect plugin <= 1.3.8 is vulnerable to Cross Site Scripting (XSS)Icegram Collect
CVE-2023-2398Icegram Engage < 3.1.12 - Reflected XSSUnknown Icegram Engage
CVE-2022-45810WordPress Email Subscribers & Newsletters Plugin <= 5.5.2 is vulnerable to CSV InjectionIcegram Express – Email Marketing, Newsletters and…
CVE-2022-3981Icegram Express < 5.5.1 - Subscriber+ SQLiUnknown Icegram Express
CVE-2021-36832WordPress Icegram plugin <= 2.0.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityIcegram
CVE-2020-5780no title heldn/a Icegram Email Subscribers & Newsletters Plugin for…
CVE-2020-5768no title heldn/a Icegram Email Subscribers & Newsletters Plugin for…
CVE-2020-5767no title heldn/a Icegram Email Subscribers & Newsletters Plugin for…
CVE-2018-0602no title heldicegram Email Subscribers & Newsletters

50 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.

Everything on this page is free. Public data. Withholding it protects nothing.