VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

Email Subscribers & Newsletters by Icegram Express – Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress security & vulnerabilities

email-subscribers— active installsLast vulnerability Sep 21, 2026

No known unpatched vulnerabilities in the latest version

All 47 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin
47Known vulnerabilities
  • Critical6
  • High8
  • Medium33
  • Low0
Vulnerabilities per year
2015: 1 vulnerability1152018: 2 vulnerabilities2182019: 8 vulnerabilities8192020: 3 vulnerabilities3202022: 2 vulnerabilities2222023: 2 vulnerabilities2232024: 18 vulnerabilities18242025: 5 vulnerabilities5252026: 6 vulnerabilities626

All Email Subscribers & Newsletters by Icegram Express – Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress vulnerabilities

Email Subscribers & Newsletters by Icegram Express – Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress vulnerabilities
SeverityVulnerabilityCVEPublished
Medium5.3Missing Authorization
≤5.9.34Update to 5.9.35
CVE-2026-83555
Medium6.5Unauthenticated Arbitrary Shortcode Execution via Subscriber Name Field
≤5.9.27Update to 5.9.28
CVE-2026-12757
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
≤5.8.5Update to 5.8.6
CVE-2025-15692
High7.2Unauthenticated Stored Cross-Site Scripting
≤5.9.33Update to 5.9.34
CVE-2026-81290
Medium4.3Missing Authorization to Authenticated (Contributor+) Settings Modification via ig_es_handle_request AJAX Action
≤5.9.27Update to 5.9.28
CVE-2026-11592
Medium6.5Authenticated (Administrator+) SQL Injection via 'workflow_ids' Parameter
≤5.9.16Update to 5.9.17
CVE-2026-1651
Medium5.3Missing Authentication to Unauthenticated Action Scheduler Task Execution
≤5.9.10Update to 5.9.11
CVE-2025-12348
Medium5.3Missing Authentication to Unauthenticated Mailing Queue Trigger
≤5.9.10Update to 5.9.11
CVE-2025-12349
Medium6.6Authenticated (Administrator+) PHP Object Injection
≤5.9.10Update to 5.9.11
CVE-2025-66055
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
≤5.7.49Update to 5.7.50
CVE-2025-0671
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
≤5.7.51Update to 5.7.52
CVE-2024-11924
Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting via Form Settings
≤5.7.44Update to 5.7.45
CVE-2024-12567
Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting via Workflow Settings
≤5.7.44Update to 5.7.45
CVE-2024-12568
Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
≤5.7.44Update to 5.7.45
CVE-2024-12566
Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting via Text Block
≤5.7.44Update to 5.7.45
CVE-2024-11636
Medium4.9Authenticated (Admin+) SQL Injection
≤5.7.43Update to 5.7.44
CVE-2024-12311
Medium5.4Authenticated (Subscriber+) Arbitrary Shortcode Execution
≤5.7.34Update to 5.7.35
CVE-2024-8254
Medium4.3Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure
≤5.7.34Update to 5.7.35
CVE-2024-8771
Medium4.3Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.26 - Missing Authorization
≤5.7.26Update to 5.7.27
CVE-2024-5703
Critical9.8Unauthenticated SQL Injection via unsubscribe
≤5.7.25Update to 5.7.26
CVE-2024-6172
Critical9.8Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.23 - Unauthenticated SQL Injection via optin
≤5.7.23Update to 5.7.24
CVE-2024-5756
High8.8Authenticated (Subscriber+) SQL Injection Vulnerability via options[list_id]
≤5.7.22Update to 5.7.23
CVE-2024-4845
Critical9.8Unauthenticated SQL Injection via hash
≤5.7.20Update to 5.7.21
CVE-2024-4295
Medium4.3Missing Authorization
≤5.7.17Update to 5.7.18
CVE-2024-3626
High8.8Missing Authorization in handle_ajax_request
≤5.7.19Update to 5.7.20
CVE-2024-4010
Critical9.8Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.14 - Unauthenticated SQL Injection
≤5.7.14Update to 5.7.15
CVE-2024-2876
Medium4.4Authenticated (Administrator+) Cross-Site Scripting via CSV import
≤5.7.15Update to 5.7.16
CVE-2024-2656
Medium5.3Missing Authorization
≤5.7.13Update to 5.7.14
CVE-2024-31352
Medium6.1Reflected Cross-Site Scripting via campaign_id
≤5.7.11Update to 5.7.12
CVE-2024-22300
Critical9.1Authenticated (Administrator+) Directory Traversal to Arbitrary File Read
≤5.6.23Update to 5.6.24
CVE-2023-5414
Medium6.5Unauthenticated CSV Injection
≤5.5.2Update to 5.5.3
CVE-2022-45810
High8.8Authenticated (Subscriber+) SQL Injection
≤5.4.19Update to 5.5.0
CVE-2022-3981
High8.8Authenticated (or Cross-Site Request Forgery) Blind SQL Injection
<5.3.2Update to 5.3.2
CVE-2022-0439
Medium5.3Unauthenticated Email Forgery
<4.5.6Update to 4.5.6
CVE-2020-5780
Medium4.9Authenticated SQL Injection
<4.5.1Update to 4.5.1
CVE-2020-5768
High8.8Cross-Site Request Forgery
<4.5.1Update to 4.5.1
CVE-2020-5767
Medium4.3Missing Authorization to Test Email
≤4.2.2Update to 4.2.3
CVE-2019-19980
Medium5.8Unauthenticated File Download w/ Information Disclosure
≤4.2.2Update to 4.2.3
CVE-2019-19985
Medium6.3 Missing Authorization
≤4.2.2Update to 4.2.3
CVE-2019-19984
High8.3Unauthenticated Blind SQL Injection
≤4.3.0Update to 4.3.1
CVE-2019-20361
Medium5.4Cross-Site Request Forgery on Settings
≤4.2.2Update to 4.2.3
CVE-2019-19981
Medium6.5Unauthenticated Option Creation
≤4.2.2Update to 4.2.3
CVE-2019-19982
Critical9.8SQL Injection
≤4.1.7Update to 4.1.8
CVE-2019-13569
Medium6.1Cross-Site Scripting
≤4.1.6Update to 4.1.7
CVE-2019-14364
Medium6.1Cross-Site Scripting
≤3.4.12Update to 3.5.0
CVE-2018-0602
High7.5Unauthenticated Subscriber Download
≤3.4.7Update to 3.4.8
CVE-2018-6015
Medium6.1Cross-Site Scripting
<2.9.1Update to 2.9.1
—

Email Subscribers & Newsletters by Icegram Express – Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress: common questions

Does Email Subscribers & Newsletters by Icegram Express – Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress have known vulnerabilities?

Yes. VulnCrest Radar lists 47 known vulnerabilities in Email Subscribers & Newsletters by Icegram Express – Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress: 6 critical, 8 high, 33 medium. None are known to affect version null.

How do I check which version of Email Subscribers & Newsletters by Icegram Express – Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent Email Subscribers & Newsletters by Icegram Express – Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress vulnerability?

CVE-2026-83555, published Sep 21, 2026: Email Subscribers by Icegram Express <= 5.9.34 - Missing Authorization. Severity: Medium (CVSS 5.3).

Is any Email Subscribers & Newsletters by Icegram Express – Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress vulnerability listed in CISA KEV?

No. None of the known Email Subscribers & Newsletters by Icegram Express – Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?