CVE-2026-12757Email Subscribers & Newsletters <= 5.9.27 - Unauthenticated Arbitrary Shortcode Execution via Subscriber Name Field Exploitation status Not known exploited Fix Affected product E Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress Published 09/07/2026 Severity Medium CVE-2026-81290WordPress Email Subscribers & Newsletters plugin <= 5.9.33 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product E Email Subscribers & Newsletters Published 08/31/2026 Severity High CVE-2026-15951Icegram Mailer <= 1.0.12 - Authenticated (Administrator+) SQL Injection via 'fields' Parameter Exploitation status Not known exploited Fix Affected product I Icegram Mailer – Reliable Email Deliverability, No-code SMTP Replacement & Email logs Published 08/01/2026 Severity Medium CVE-2026-16087Icegram Engage <= 3.1.42 - Authenticated (Contributor+) Second-Order SQL Injection via 'messages[][id]' Parameter Exploitation status Not known exploited Fix Affected product I Icegram Engage – Popups, Optins, CTAs & Lead Generation Published 08/01/2026 Severity Medium CVE-2026-11592Email Subscribers & Newsletters <= 5.9.27 - Missing Authorization to Authenticated (Contributor+) Settings Modification via ig_es_handle_request AJAX Action Exploitation status Not known exploited Fix Affected product E Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress Published 07/02/2026 Severity Medium CVE-2026-1651Email Subscribers & Newsletters <= 5.9.16 - Authenticated (Administrator+) SQL Injection via 'workflow_ids' Parameter Exploitation status Public exploit Fix Affected product E Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress Published 03/04/2026 Severity Medium CVE-2025-68507WordPress Icegram plugin <= 3.1.35 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product I Icegram Published 01/22/2026 Severity Medium CVE-2025-68038WordPress Icegram Express Pro plugin < 5.9.14 - PHP Object Injection vulnerability Exploitation status Not known exploited Fix Affected product I Icegram Express Pro Published 12/24/2025 Severity High CVE-2025-12348Email Subscribers & Newsletters <= 5.9.10 - Missing Authentication to Unauthenticated Action Scheduler Task Execution Exploitation status Not known exploited Fix Affected product E Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress Published 12/12/2025 Severity Medium CVE-2025-66055WordPress Email Subscribers & Newsletters plugin <= 5.9.10 - PHP Object Injection vulnerability Exploitation status Not known exploited Fix Affected product E Email Subscribers & Newsletters Published 11/21/2025 Severity High CVE-2025-12349Email Subscribers & Newsletters <= 5.9.10 - Missing Authentication to Unauthenticated Mailing Queue Trigger Exploitation status Not known exploited Fix Affected product E Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress Published 11/19/2025 Severity Medium CVE-2025-49917WordPress Icegram Express Pro plugin <= 5.9.5 - Server Side Request Forgery (SSRF) vulnerability Exploitation status Not known exploited Fix Affected product I Icegram Express Pro Published 10/22/2025 Severity Medium CVE-2025-47527WordPress Icegram Collect – Easy Form, Lead Collection and Subscription plugin <= 1.3.18 - Broken Access Control Vulnerability Exploitation status Not known exploited Fix Affected product I Icegram Collect Published 06/09/2025 Severity High CVE-2024-13486Icegram Engage < 3.1.32 - Admin+ Stored XSS Exploitation status Public exploit Fix Affected product I Icegram Engage Published 05/15/2025 Severity Medium CVE-2024-13482Icegram Engage < 3.1.32 - Admin+ Stored XSS Exploitation status Public exploit Fix Affected product I Icegram Engage Published 05/15/2025 Severity Medium CVE-2025-0671Email Subscribers < 5.7.50 - Admin+ Stored XSS in Template Exploitation status Public exploit Fix Affected product I Icegram Express Published 04/25/2025 Severity Medium CVE-2024-11924Email Subscribers < 5.7.52 - Admin+ Stored XSS Exploitation status Public exploit Fix Affected product I Icegram Express formerly known as Email Subscribers Published 04/17/2025 Severity Low CVE-2025-24542WordPress Icegram Engage plugin <= 3.1.31 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product I Icegram Published 01/24/2025 Severity Medium CVE-2024-12568Email Subscribers < 5.7.45 - Admin+ Stored XSS Exploitation status Public exploit Fix Affected product E Email Subscribers by Icegram Express Published 01/13/2025 Severity Medium CVE-2024-12567Email Subscribers < 5.7.45 - Admin+ Stored XSS Exploitation status Public exploit Fix Affected product E Email Subscribers by Icegram Express Published 01/13/2025 Severity Medium CVE-2024-12566Email Subscribers < 5.7.45 - Admin+ Stored XSS Exploitation status Public exploit Fix Affected product E Email Subscribers by Icegram Express Published 01/13/2025 Severity Medium CVE-2024-11636Email Subscribers < 5.7.45 - Admin+ Stored XSS Exploitation status Public exploit Fix Affected product E Email Subscribers by Icegram Express Published 01/13/2025 Severity Medium CVE-2024-12311Email Subscribers < 5.7.44 - Admin+ SQL Injection Exploitation status Public exploit Fix Affected product E Email Subscribers by Icegram Express Published 01/06/2025 Severity Medium CVE-2024-12302Icegram Engage < 3.1.32 - Author+ Stored XSS Exploitation status Public exploit Fix Affected product I Icegram Engage Published 01/06/2025 Severity Medium CVE-2024-39625WordPress Icegram Engage plugin <= 3.1.24 - Unauthenticated Message Duplication Vulnerability Exploitation status Not known exploited Fix Affected product I Icegram Published 11/01/2024 Severity Medium CVE-2024-43273WordPress Icegram Collect plugin <= 1.3.14 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product I Icegram Collect Published 11/01/2024 Severity Medium CVE-2024-8254Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.34 - Authenticated (Subscriber+) Arbitrary Shortcode Execution Exploitation status Not known exploited Fix Affected product E Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress Published 10/02/2024 Severity Medium CVE-2024-8771Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.34 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure Exploitation status Not known exploited Fix Affected product E Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress Published 09/26/2024 Severity Medium CVE-2024-43272WordPress Icegram Engage plugin <= 3.1.24 - Unauthenticated Unpublished Campaign Viewer vulnerability Exploitation status Not known exploited Fix Affected product I Icegram Published 08/19/2024 Severity Medium CVE-2024-43344WordPress Icegram Engage – Ultimate WP Popup Builder, Lead Generation, Optins, and CTA plugin <= 3.1.25 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product I Icegram Published 08/18/2024 Severity Medium CVE-2024-5703Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.26 - Missing Authorization Exploitation status Not known exploited Fix Affected product E Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress Published 07/17/2024 Severity Medium CVE-2024-6172Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.25 - Unauthenticated SQL Injection via unsubscribe Exploitation status Not known exploited Fix Affected product E Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress Published 07/02/2024 Severity Critical CVE-2024-37252WordPress Email Subscribers by Icegram Express plugin <= 5.7.25 - SQL Injection vulnerability Exploitation status Not known exploited Fix Affected product E Email Subscribers & Newsletters Published 06/26/2024 Severity Critical CVE-2024-5756Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.23 - Unauthenticated SQL Injection via optin Exploitation status Not known exploited Fix Affected product E Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress Published 06/21/2024 Severity Critical CVE-2024-4845Icegram Express <= 5.7.22 - Authenticated (Subscriber+) SQL Injection Vulnerability via options[list_id] Exploitation status Not known exploited Fix Affected product E Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress Published 06/12/2024 Severity High CVE-2024-31352WordPress Icegram Express plugin <= 5.7.13 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product E Email Subscribers & Newsletters Published 06/09/2024 Severity Medium CVE-2024-21748WordPress Icegram Engage plugin <= 3.1.21 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product I Icegram Published 06/08/2024 Severity Medium CVE-2024-4295Email Subscribers by Icegram Express <= 5.7.20 - Unauthenticated SQL Injection via hash Exploitation status Not known exploited Fix Affected product E Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress Published 06/05/2024 Severity Critical CVE-2024-3626Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.17 - Missing Authorization Exploitation status Not known exploited Fix Affected product E Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress Published 05/23/2024 Severity Medium CVE-2024-4010Email Subscribers by Icegram Express <= 5.7.19 - Missing Authorization in handle_ajax_request Exploitation status Not known exploited Fix Affected product E Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress Published 05/15/2024 Severity High CVE-2024-2876Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.14 - Unauthenticated SQL Injection Exploitation status Not known exploited Fix Affected product E Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress Published 05/02/2024 Severity Critical CVE-2024-2656Icegram Express <= 5.7.14 - Authenticated (Administrator+) Cross-Site Scripting via CSV import Exploitation status Not known exploited Fix Affected product E Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress Published 04/06/2024 Severity Medium CVE-2024-22300WordPress Icegram Express plugin <= 5.7.11 - Reflected Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product E Email Subscribers & Newsletters Published 03/27/2024 Severity High CVE-2023-51532WordPress Icegram Plugin <= 3.1.19 is vulnerable to Cross Site Scripting (XSS) Exploitation status Not known exploited Fix Affected product I Icegram Engage – WordPress Lead Generation, Popup Builder, CTA, Optins and Email List Building Published 02/01/2024 Severity Medium CVE-2023-52119WordPress Icegram Plugin <= 3.1.18 is vulnerable to Cross Site Request Forgery (CSRF) Exploitation status Not known exploited Fix Affected product I Icegram Engage – WordPress Lead Generation, Popup Builder, CTA, Optins and Email List Building Published 01/05/2024 Severity Medium CVE-2022-45810WordPress Email Subscribers & Newsletters Plugin <= 5.5.2 is vulnerable to CSV Injection Exploitation status Not known exploited Fix Affected product I Icegram Express – Email Marketing, Newsletters and Automation for WordPress & WooCommerce Published 11/07/2023 Severity Critical CVE-2023-5414Icegram Express <= 5.6.23 - Authenticated (Administrator+) Directory Traversal to Arbitrary File Read Exploitation status Not known exploited Fix Affected product E Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress Published 10/20/2023 Severity Critical CVE-2023-2398Icegram Engage < 3.1.12 - Reflected XSS Exploitation status Public exploit Fix Affected product I Icegram Engage Published 06/12/2023 Severity Unknown CVE-2023-25024WordPress Icegram Collect plugin <= 1.3.8 is vulnerable to Cross Site Scripting (XSS) Exploitation status Not known exploited Fix Affected product I Icegram Collect Published 04/07/2023 Severity Medium CVE-2022-3981Icegram Express < 5.5.1 - Subscriber+ SQLi Exploitation status Public exploit Fix Affected product I Icegram Express Published 12/12/2022 Severity High CVE-2022-1776Icegram < 2.1.8 - Contributor+ Stored Cross-Site Scripting Exploitation status Not confirmed Fix Affected product P Popups, Welcome Bar, Optins and Lead Generation Plugin – Icegram Published 06/27/2022 Severity Unknown CVE-2022-0439Email Subscribers & Newsletters < 5.3.2 - Subscriber+ Blind SQL injection Exploitation status Public exploit Fix Affected product E Email Subscribers & Newsletters Published 03/07/2022 Severity Unknown CVE-2021-24941Icegram < 2.0.5 - Reflected Cross-Site Scripting Exploitation status Not confirmed Fix Affected product P Popups, Welcome Bar, Optins and Lead Generation Plugin – Icegram Published 12/21/2021 Severity Unknown CVE-2021-36832WordPress Icegram plugin <= 2.0.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product P Popups, Welcome Bar, Optins and Lead Generation Plugin – Icegram Published 10/19/2021 Severity Medium CVE-2020-5780Exploitation status Not confirmed Fix Not confirmed Affected product I Icegram Email Subscribers & Newsletters Plugin for WordPress Published 09/10/2020 Severity Unknown CVE-2020-5767Exploitation status Not confirmed Fix Not confirmed Affected product I Icegram Email Subscribers & Newsletters Plugin for WordPress Published 07/17/2020 Severity Unknown CVE-2020-5768Exploitation status Not confirmed Fix Not confirmed Affected product I Icegram Email Subscribers & Newsletters Plugin for WordPress Published 07/17/2020 Severity Unknown CVE-2019-20361Exploitation status Not confirmed Fix Not confirmed Affected product Not confirmed Published 01/08/2020 Severity High CVE-2019-19980Exploitation status Not confirmed Fix Not confirmed Affected product Not confirmed Published 12/26/2019 Severity Medium CVE-2019-19981Exploitation status Not confirmed Fix Not confirmed Affected product Not confirmed Published 12/26/2019 Severity Medium CVE-2019-19982Exploitation status Not confirmed Fix Not confirmed Affected product Not confirmed Published 12/26/2019 Severity Medium CVE-2019-19984Exploitation status Not confirmed Fix Not confirmed Affected product Not confirmed Published 12/26/2019 Severity Medium CVE-2019-19985Exploitation status Not confirmed Fix Not confirmed Affected product Not confirmed Published 12/26/2019 Severity Medium CVE-2016-10963Exploitation status Not confirmed Fix Not confirmed Affected product Not confirmed Published 09/16/2019 Severity Unknown CVE-2016-10962Exploitation status Not confirmed Fix Not confirmed Affected product Not confirmed Published 09/16/2019 Severity Unknown CVE-2019-15830Exploitation status Not confirmed Fix Not confirmed Affected product Not confirmed Published 08/30/2019 Severity Unknown CVE-2019-14364Exploitation status Not confirmed Fix Not confirmed Affected product Not confirmed Published 07/28/2019 Severity Unknown CVE-2019-13569Exploitation status Not confirmed Fix Not confirmed Affected product Not confirmed Published 07/19/2019 Severity Unknown CVE-2018-0602Exploitation status Not confirmed Fix Not confirmed Affected product E Email Subscribers & Newsletters Published 06/26/2018 Severity Unknown CVE-2018-6015Exploitation status Public exploit Fix Not confirmed Affected product Not confirmed Published 01/26/2018 Severity Unknown 
