Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

7 records

Vendor: icegram Component: Icegram Express Clear all filters
TI-2025-00565 CVE-2025-0671 · GHSA-4c3f-c9v6-jqxm

Email Subscribers < 5.7.50 - Admin+ Stored XSS in Template

Priority MEDIUM 60

The Icegram Express WordPress plugin before 5.7.50 does not sanitise and escape some of its Template settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00285 Published 2025-04-25 Fixed in 5.7.50 CWE-79
TI-2024-11063 CVE-2024-11924 · GHSA-p345-jmhp-7wg2

Email Subscribers < 5.7.52 - Admin+ Stored XSS

Priority MEDIUM 50

The Icegram Express formerly known as Email Subscribers WordPress plugin before 5.7.52 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site…

CVSS 3.1LOW 3.5 Network High privileges User interaction EPSS 0.00272 Published 2025-04-17 Fixed in 5.7.52 CWE-79
TI-2024-05345 CVE-2024-5756 · GHSA-grp4-qf6x-8325

SQL injection in icegram Email Subscribers & Newsletters – Email Marketing, Post…

Priority MEDIUM 50

The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the db parameter in all versions up to, a…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00688 Published 2024-06-21 No fix listed CWE-89
TI-2024-04508 CVE-2024-4845 · GHSA-8xpj-rxm7-wgf9

Icegram Express <= 5.7.22 - Authenticated (Subscriber+) SQL Injection Vulnerability via options[list_id]

Priority LOW 38

The Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘options[list_id]’ parameter in all versions up to, and including, 5.7.22 due to insufficient escaping on the user supplied parameter and la…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00454 Published 2024-06-12 No fix listed CWE-89
TI-2022-22614 CVE-2022-45810 · GHSA-wr7v-h9p2-5fr6

WordPress Email Subscribers & Newsletters Plugin <= 5.5.2 is vulnerable to CSV Injection

Priority MEDIUM 50

Improper Neutralization of Formula Elements in a CSV File vulnerability in Icegram Icegram Express – Email Marketing, Newsletters and Automation for WordPress & WooCommerce.This issue affects Icegram Express – Email Mark…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00638 Published 2023-11-07 No fix listed CWE-1236