Vulnerabilities in Icegram

37 results
Vexday analysis

Icegram possui 15 vulnerabilidades registradas, predominantemente de injeção de script (CWE-79), com apenas 1 crítica e nenhuma sob exploração ativa conhecida. O portfólio não apresenta exposições recentes significativas, com a última divulgação anterior aos últimos 90 dias, indicando risco controlado e estável no curto prazo.

CVE-2026-1651MEDIUMEmail Subscribers & Newsletters <= 5.9.16 - Authenticated (Administrator+) SQL Injection via 'workflow_ids' ParameterEPSS 0.4%CVE-2024-43272MEDIUMWordPress Icegram Engage plugin <= 3.1.24 - Unauthenticated Unpublished Campaign Viewer vulnerabilityEPSS 0.4%CVE-2024-8771MEDIUMEmail Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.34 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information ExposureEPSS 0.4%CVE-2024-39625MEDIUMWordPress Icegram Engage plugin <= 3.1.24 - Unauthenticated Message Duplication VulnerabilityEPSS 0.4%CVE-2024-2656MEDIUMIcegram Express <= 5.7.14 - Authenticated (Administrator+) Cross-Site Scripting via CSV importEPSS 0.4%CVE-2023-51532MEDIUMWordPress Icegram Plugin <= 3.1.19 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2025-12349MEDIUMEmail Subscribers & Newsletters <= 5.9.10 - Missing Authentication to Unauthenticated Mailing Queue TriggerEPSS 0.3%CVE-2024-21748MEDIUMWordPress Icegram Engage plugin <= 3.1.21 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-47527HIGHWordPress Icegram Collect – Easy Form, Lead Collection and Subscription plugin <= 1.3.18 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2025-24542MEDIUMWordPress Icegram Engage plugin <= 3.1.31 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-11592MEDIUMEmail Subscribers & Newsletters <= 5.9.27 - Missing Authorization to Authenticated (Contributor+) Settings Modification via ig_es_handle_request AJAX ActionEPSS 0.3%CVE-2026-16087MEDIUMIcegram Engage <= 3.1.42 - Authenticated (Contributor+) Second-Order SQL Injection via 'messages[][id]' ParameterEPSS 0.3%CVE-2026-15951MEDIUMIcegram Mailer <= 1.0.12 - Authenticated (Administrator+) SQL Injection via 'fields' ParameterEPSS 0.3%CVE-2024-43344MEDIUMWordPress Icegram Engage – Ultimate WP Popup Builder, Lead Generation, Optins, and CTA plugin <= 3.1.25 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-68507MEDIUMWordPress Icegram plugin <= 3.1.35 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2023-52119MEDIUMWordPress Icegram Plugin <= 3.1.18 is vulnerable to Cross Site Request Forgery (CSRF)EPSS 0.2%CVE-2025-49917MEDIUMWordPress Icegram Express Pro plugin <= 5.9.5 - Server Side Request Forgery (SSRF) vulnerabilityEPSS 0.2%