WordPress plugin

Icegram Engage – Popups, Welcome Bars, Optins, Slide-Ins & Lead Generation for WordPress security & vulnerabilities

Q: Does Icegram Engage – Popups, Welcome Bars, Optins, Slide-Ins & Lead Generation for WordPress have known vulnerabilities?

Yes. VulnCrest Radar lists 20 known vulnerabilities in Icegram Engage – Popups, Welcome Bars, Optins, Slide-Ins & Lead Generation for WordPress: 2 high, 18 medium. None are known to affect version null.

Q: How do I check which version of Icegram Engage – Popups, Welcome Bars, Optins, Slide-Ins & Lead Generation for WordPress I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

Q: What is the most recent Icegram Engage – Popups, Welcome Bars, Optins, Slide-Ins & Lead Generation for WordPress vulnerability?

CVE-2026-97284, published Oct 1, 2026: Icegram Engage – Popups, Optins, CTAs & Lead Generation <= 3.1.31 - Authenticated (Contributor+) PHP Object Injection. Severity: High (CVSS 7.5).

Q: Is any Icegram Engage – Popups, Welcome Bars, Optins, Slide-Ins & Lead Generation for WordPress vulnerability listed in CISA KEV?

No. None of the known Icegram Engage – Popups, Welcome Bars, Optins, Slide-Ins & Lead Generation for WordPress vulnerabilities is currently listed in the CISA KEV catalog.

icegram— active installsLast vulnerability Oct 1, 2026

No known unpatched vulnerabilities in the latest version

All 20 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin

20Known vulnerabilities

Critical0
High2
Medium18
Low0

Vulnerabilities per year

All Icegram Engage – Popups, Welcome Bars, Optins, Slide-Ins & Lead Generation for WordPress vulnerabilities

Icegram Engage – Popups, Welcome Bars, Optins, Slide-Ins & Lead Generation for WordPress vulnerabilities
Severity	Vulnerability	CVE	Published
High7.5	Authenticated (Contributor+) PHP Object Injection ≤3.1.31Update to 3.1.44	CVE-2026-97284	Oct 01
Medium6.5	Authenticated (Contributor+) Second-Order SQL Injection via 'messages[][id]' Parameter ≤3.1.42Update to 3.1.43	CVE-2026-16087	Jul 31
Medium5.3	Missing Authorization ≤3.1.35Update to 3.1.36	CVE-2025-68507	Jan 05
Medium4.4	Authenticated (Administrator+) Stored Cross-Site Scripting ≤3.1.31Update to 3.1.32	CVE-2024-13482	Mar 3, 2025
Medium4.4	Authenticated (Administrator+) Stored Cross-Site Scripting ≤3.1.31Update to 3.1.32	CVE-2024-13486	Mar 3, 2025
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting ≤3.1.31Update to 3.1.32	CVE-2025-24542	Jan 24, 2025
Medium6.4	Authenticated (Author+) Stored Cross-Site Scripting ≤3.1.31Update to 3.1.32	CVE-2024-12302	Dec 16, 2024
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting ≤3.1.25Update to 3.1.26	CVE-2024-43344	Aug 16, 2024
Medium5.3	Missing Authorization ≤3.1.24Update to 3.1.25	CVE-2024-43272	Aug 12, 2024
Medium5.3	Missing Authorization to Unauthenticated Message Duplication ≤3.1.24Update to 3.1.25	CVE-2024-39625	Jul 22, 2024
Medium4.3	Missing Authorization ≤3.1.21Update to 3.1.22	CVE-2024-21748	Jan 5, 2024
Medium4.3	Cross-Site Request Forgery via save_campaign_preview ≤3.1.18Update to 3.1.19	CVE-2023-52119	Dec 28, 2023
Medium6.4	Authenticated (Contributor+) Stored Cross-Site Scripting via Campaign Message ≤3.1.19Update to 3.1.20	CVE-2023-51532	Dec 27, 2023
Medium6.1	Reflected Cross-Site Scripting ≤3.1.11Update to 3.1.12	CVE-2023-2398	May 22, 2023
Medium6.1	Cross-Site Scripting <2.1.8Update to 2.1.8	CVE-2022-1776	May 30, 2022
Medium6.1	Reflected Cross-Site Scripting via message_id <2.0.5Update to 2.0.5	CVE-2021-24941	Nov 22, 2021
Medium4.8	Authenticated Stored Cross-Site Scripting ≤2.0.2Update to 2.0.3	CVE-2021-36832	Aug 17, 2021
Medium6.4	Cross-Site Scripting ≤1.10.28.2Update to 1.10.29	CVE-2019-15830	Jul 9, 2019
High8.8	Cross-Site Request Forgery <1.9.19Update to 1.9.19	CVE-2016-10962	Jul 19, 2016
Medium6.1	Cross-Site Scripting <1.9.19Update to 1.9.19	CVE-2016-10963	Jul 19, 2016

High7.5
Authenticated (Contributor+) PHP Object Injection
≤3.1.31Update to 3.1.44
CVE-2026-97284Oct 01
Medium6.5
Authenticated (Contributor+) Second-Order SQL Injection via 'messages[][id]' Parameter
≤3.1.42Update to 3.1.43
CVE-2026-16087Jul 31
Medium5.3
Missing Authorization
≤3.1.35Update to 3.1.36
CVE-2025-68507Jan 05
Medium4.4
Authenticated (Administrator+) Stored Cross-Site Scripting
≤3.1.31Update to 3.1.32
CVE-2024-13482Mar 3, 2025
Medium4.4
Authenticated (Administrator+) Stored Cross-Site Scripting
≤3.1.31Update to 3.1.32
CVE-2024-13486Mar 3, 2025
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.1.31Update to 3.1.32
CVE-2025-24542Jan 24, 2025
Medium6.4
Authenticated (Author+) Stored Cross-Site Scripting
≤3.1.31Update to 3.1.32
CVE-2024-12302Dec 16, 2024
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.1.25Update to 3.1.26
CVE-2024-43344Aug 16, 2024
Medium5.3
Missing Authorization
≤3.1.24Update to 3.1.25
CVE-2024-43272Aug 12, 2024
Medium5.3
Missing Authorization to Unauthenticated Message Duplication
≤3.1.24Update to 3.1.25
CVE-2024-39625Jul 22, 2024
Medium4.3
Missing Authorization
≤3.1.21Update to 3.1.22
CVE-2024-21748Jan 5, 2024
Medium4.3
Cross-Site Request Forgery via save_campaign_preview
≤3.1.18Update to 3.1.19
CVE-2023-52119Dec 28, 2023
Medium6.4
Authenticated (Contributor+) Stored Cross-Site Scripting via Campaign Message
≤3.1.19Update to 3.1.20
CVE-2023-51532Dec 27, 2023
Medium6.1
Reflected Cross-Site Scripting
≤3.1.11Update to 3.1.12
CVE-2023-2398May 22, 2023
Medium6.1
Cross-Site Scripting
<2.1.8Update to 2.1.8
CVE-2022-1776May 30, 2022
Medium6.1
Reflected Cross-Site Scripting via message_id
<2.0.5Update to 2.0.5
CVE-2021-24941Nov 22, 2021
Medium4.8
Authenticated Stored Cross-Site Scripting
≤2.0.2Update to 2.0.3
CVE-2021-36832Aug 17, 2021
Medium6.4
Cross-Site Scripting
≤1.10.28.2Update to 1.10.29
CVE-2019-15830Jul 9, 2019
High8.8
Cross-Site Request Forgery
<1.9.19Update to 1.9.19
CVE-2016-10962Jul 19, 2016
Medium6.1
Cross-Site Scripting
<1.9.19Update to 1.9.19
CVE-2016-10963Jul 19, 2016

Icegram Engage – Popups, Welcome Bars, Optins, Slide-Ins & Lead Generation for WordPress: common questions

Does Icegram Engage – Popups, Welcome Bars, Optins, Slide-Ins & Lead Generation for WordPress have known vulnerabilities?

Yes. VulnCrest Radar lists 20 known vulnerabilities in Icegram Engage – Popups, Welcome Bars, Optins, Slide-Ins & Lead Generation for WordPress: 2 high, 18 medium. None are known to affect version null.

How do I check which version of Icegram Engage – Popups, Welcome Bars, Optins, Slide-Ins & Lead Generation for WordPress I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent Icegram Engage – Popups, Welcome Bars, Optins, Slide-Ins & Lead Generation for WordPress vulnerability?

CVE-2026-97284, published Oct 1, 2026: Icegram Engage – Popups, Optins, CTAs & Lead Generation <= 3.1.31 - Authenticated (Contributor+) PHP Object Injection. Severity: High (CVSS 7.5).

Is any Icegram Engage – Popups, Welcome Bars, Optins, Slide-Ins & Lead Generation for WordPress vulnerability listed in CISA KEV?

No. None of the known Icegram Engage – Popups, Welcome Bars, Optins, Slide-Ins & Lead Generation for WordPress vulnerabilities is currently listed in the CISA KEV catalog.