Read the docs

icegram

Records71All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical10CVSS 9.0–10.0
CVSS high12CVSS 7.0–8.9

Exploited now

icegram records in CISA KEV

No icegram vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Email Subscribers & Newsletters 25 records HIGH Icegram Engage 10 records MEDIUM Icegram Express 7 records MEDIUM Icegram 1 record LOW Icegram Collect 1 record LOW Popups, Welcome Bar, Optins And Lead Generation Plugin 1 record LOW

Records

10 records in Icegram Engage · all components

TI-2024-11412 CVE-2024-12302 · GHSA-24m8-vx7p-q7mf

Icegram Engage < 3.1.32 - Author+ Stored XSS

Priority MEDIUM 60

The Icegram Engage WordPress plugin before 3.1.32 does not sanitise and escape some of its Campaign settings, which could allow authors and above to perform Stored Cross-Site Scripting attacks

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00367 Published 2025-01-06 Fixed in 3.1.32 CWE-79
TI-2023-02253 CVE-2023-2398 · GHSA-43qj-8555-mr85

Icegram Engage < 3.1.12 - Reflected XSS

Priority MEDIUM 60

The Icegram Engage WordPress plugin before 3.1.12 does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such a…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00486 Published 2023-06-12 Fixed in 3.1.12
TI-2024-12527 CVE-2024-13486 · GHSA-89wf-mr2w-22xh

Icegram Engage < 3.1.32 - Admin+ Stored XSS

Priority MEDIUM 55

The Icegram Engage WordPress plugin before 3.1.32 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfil…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00326 Published 2025-05-15 Fixed in 3.1.32 CWE-79
TI-2024-12523 CVE-2024-13482 · GHSA-pr6c-x44x-mpwc

Icegram Engage < 3.1.32 - Admin+ Stored XSS

Priority MEDIUM 55

The Icegram Engage WordPress plugin before 3.1.32 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfil…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00308 Published 2025-05-15 Fixed in 3.1.32 CWE-79
TI-2023-28558 CVE-2023-52119 · GHSA-jfch-7m53-3fxv

WordPress Icegram Plugin <= 3.1.18 is vulnerable to Cross Site Request Forgery (CSRF)

Priority LOW 37

Cross-Site Request Forgery (CSRF) vulnerability in Icegram Icegram Engage – WordPress Lead Generation, Popup Builder, CTA, Optins and Email List Building.This issue affects Icegram Engage – WordPress Lead Generation, Pop…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00223 Published 2024-01-05 No fix listed CWE-352
TI-2023-28184 CVE-2023-51532 · GHSA-jv9f-872m-gv5x

WordPress Icegram Plugin <= 3.1.19 is vulnerable to Cross Site Scripting (XSS)

Priority LOW 29

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Icegram Icegram Engage – WordPress Lead Generation, Popup Builder, CTA, Optins and Email List Building allows Stored X…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.0031 Published 2024-02-01 No fix listed CWE-79
Open these records in search →