Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress

Vulnerabilities

• CVE-2024-6172unauthenticated≤ 5.7.25

  Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.25 - Unauthenticated SQL Injection via unsubs

  Critical 9.8

• CVE-2024-5756unauthenticated≤ 5.7.23

  Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.23 - Unauthenticated SQL Injection via optin

  Critical 9.8

• CVE-2024-31352unauthenticated≤ 5.7.13

  WordPress Icegram Express plugin <= 5.7.13 - Broken Access Control vulnerability

  Critical 9.8

• CVE-2024-4295unauthenticated≤ 5.7.20

  Email Subscribers by Icegram Express <= 5.7.20 - Unauthenticated SQL Injection via hash

  Critical 9.8

• CVE-2024-2876unauthenticated≤ 5.7.14

  Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.14 - Unauthenticated SQL Injection

  Critical 9.8

• CVE-2022-45810unauthenticated · needs a click≤ 5.5.2

  WordPress Email Subscribers & Newsletters Plugin <= 5.5.2 is vulnerable to CSV Injection

  Critical 9.8

• CVE-2019-13569unauthenticated

  A SQL injection vulnerability exists in the Icegram Email Subscribers & Newsletters plugin through 4.1.7 for WordPress.

  Critical 9.8

• CVE-2024-37252unauthenticated≤ 5.7.25

  WordPress Email Subscribers by Icegram Express plugin <= 5.7.25 - SQL Injection vulnerability

  Critical 9.3

• CVE-2024-4845subscriber+≤ 5.7.22

  Icegram Express <= 5.7.22 - Authenticated (Subscriber+) SQL Injection Vulnerability via options[list_id]

  High 8.8

• CVE-2024-4010subscriber+≤ 5.7.19

  Email Subscribers by Icegram Express <= 5.7.19 - Missing Authorization in handle_ajax_request

  High 8.8

• CVE-2018-6015unauthenticated

  An issue was discovered in the "Email Subscribers & Newsletters" plugin before 3.4.8 for WordPress.

  High 7.5

• CVE-2025-66055high privilege≤ 5.9.10

  WordPress Email Subscribers & Newsletters plugin <= 5.9.10 - PHP Object Injection vulnerability

  High 7.2

• CVE-2023-5414admin≤ 5.6.23

  Icegram Express <= 5.6.23 - Authenticated (Administrator+) Directory Traversal to Arbitrary File Read

  High 7.2

• CVE-2026-81290unauthenticated · needs a click≤ 5.9.33

  WordPress Email Subscribers & Newsletters plugin <= 5.9.33 - Cross Site Scripting (XSS) vulnerability

  High 7.1

• CVE-2024-22300unauthenticated · needs a click≤ 5.7.11

  WordPress Icegram Express plugin <= 5.7.11 - Reflected Cross Site Scripting (XSS) vulnerability

  High 7.1

• CVE-2026-12757unauthenticated≤ 5.9.27

  Email Subscribers & Newsletters <= 5.9.27 - Unauthenticated Arbitrary Shortcode Execution via Subscriber Name Field

  Medium 6.5

• CVE-2026-1651admin≤ 5.9.16

  Email Subscribers & Newsletters <= 5.9.16 - Authenticated (Administrator+) SQL Injection via 'workflow_ids' Parameter

  Medium 6.5

• CVE-2024-8254subscriber+≤ 5.7.34

  Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.34 - Authenticated (Subscriber+) Arbitrary Sh

  Medium 6.3

• CVE-2019-14364unauthenticated · needs a click

  An XSS vulnerability in the "Email Subscribers & Newsletters" plugin 4.1.6 for WordPress allows an attacker to inject malicious JavaScript c

  Medium 6.1

• CVE-2018-0602unauthenticated · needs a click

  Cross-site scripting vulnerability in Email Subscribers & Newsletters versions prior to 3.5.0 allows remote attackers to inject arbitrary we

  Medium 6.1

• CVE-2025-12348unauthenticated≤ 5.9.10

  Email Subscribers & Newsletters <= 5.9.10 - Missing Authentication to Unauthenticated Action Scheduler Task Execution

  Medium 5.3

• CVE-2025-12349unauthenticated≤ 5.9.10

  Email Subscribers & Newsletters <= 5.9.10 - Missing Authentication to Unauthenticated Mailing Queue Trigger

  Medium 5.3

• CVE-2024-2656admin≤ 5.7.15

  Icegram Express <= 5.7.14 - Authenticated (Administrator+) Cross-Site Scripting via CSV import

  Medium 4.4

• CVE-2024-8771subscriber+≤ 5.7.34

  Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.34 - Missing Authorization to Authenticated (

  Medium 4.3

• CVE-2024-5703subscriber+≤ 5.7.26

  Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.26 - Missing Authorization

  Medium 4.3

• CVE-2024-3626subscriber+≤ 5.7.17

  Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.17 - Missing Authorization

  Medium 4.3

• CVE-2026-11592contributor+≤ 5.9.27

  Email Subscribers & Newsletters <= 5.9.27 - Missing Authorization to Authenticated (Contributor+) Settings Modification via ig_es_handle_request AJAX Action

  Medium 4.3