Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

10 records

Vendor: icegram Component: Icegram Engage Clear all filters
TI-2024-12527 CVE-2024-13486 · GHSA-89wf-mr2w-22xh

Icegram Engage < 3.1.32 - Admin+ Stored XSS

Priority MEDIUM 55

The Icegram Engage WordPress plugin before 3.1.32 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfil…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00326 Published 2025-05-15 Fixed in 3.1.32 CWE-79
TI-2024-12523 CVE-2024-13482 · GHSA-pr6c-x44x-mpwc

Icegram Engage < 3.1.32 - Admin+ Stored XSS

Priority MEDIUM 55

The Icegram Engage WordPress plugin before 3.1.32 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfil…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00308 Published 2025-05-15 Fixed in 3.1.32 CWE-79
TI-2024-11412 CVE-2024-12302 · GHSA-24m8-vx7p-q7mf

Icegram Engage < 3.1.32 - Author+ Stored XSS

Priority MEDIUM 60

The Icegram Engage WordPress plugin before 3.1.32 does not sanitise and escape some of its Campaign settings, which could allow authors and above to perform Stored Cross-Site Scripting attacks

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00367 Published 2025-01-06 Fixed in 3.1.32 CWE-79
TI-2023-28184 CVE-2023-51532 · GHSA-jv9f-872m-gv5x

WordPress Icegram Plugin <= 3.1.19 is vulnerable to Cross Site Scripting (XSS)

Priority LOW 29

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Icegram Icegram Engage – WordPress Lead Generation, Popup Builder, CTA, Optins and Email List Building allows Stored X…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.0031 Published 2024-02-01 No fix listed CWE-79
TI-2023-28558 CVE-2023-52119 · GHSA-jfch-7m53-3fxv

WordPress Icegram Plugin <= 3.1.18 is vulnerable to Cross Site Request Forgery (CSRF)

Priority LOW 37

Cross-Site Request Forgery (CSRF) vulnerability in Icegram Icegram Engage – WordPress Lead Generation, Popup Builder, CTA, Optins and Email List Building.This issue affects Icegram Engage – WordPress Lead Generation, Pop…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00223 Published 2024-01-05 No fix listed CWE-352
TI-2023-02253 CVE-2023-2398 · GHSA-43qj-8555-mr85

Icegram Engage < 3.1.12 - Reflected XSS

Priority MEDIUM 60

The Icegram Engage WordPress plugin before 3.1.12 does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such a…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00486 Published 2023-06-12 Fixed in 3.1.12