Icegram

Vulnerabilities

• CVE-2026-97284

  WordPress Icegram plugin <= 3.1.31 - PHP Object Injection vulnerability

  High 8.8

• CVE-2023-52119

  WordPress Icegram Plugin <= 3.1.18 is vulnerable to Cross Site Request Forgery (CSRF)

  High 8.8

• CVE-2026-16087

  Icegram Engage <= 3.1.42 - Authenticated (Contributor+) Second-Order SQL Injection via 'messages[][id]' Parameter

  Medium 6.5

• CVE-2025-68507

  WordPress Icegram plugin <= 3.1.35 - Broken Access Control vulnerability

  Medium 6.5

• CVE-2025-24542

  WordPress Icegram Engage plugin <= 3.1.31 - Cross Site Scripting (XSS) vulnerability

  Medium 6.5

• CVE-2024-43344

  WordPress Icegram Engage – Ultimate WP Popup Builder, Lead Generation, Optins, and CTA plugin <= 3.1.25 - Cross Site Scripting (XSS) vulnerability

  Medium 6.5

• CVE-2016-10962

  The icegram plugin before 1.9.19 for WordPress has CSRF via the wp-admin/edit.php option_name parameter.

  Medium 6.5

• CVE-2016-10963

  The icegram plugin before 1.9.19 for WordPress has XSS.

  Medium 6.1

• CVE-2024-21748

  WordPress Icegram Engage plugin <= 3.1.21 - Broken Access Control vulnerability

  Medium 5.4

• CVE-2023-51532

  WordPress Icegram Plugin <= 3.1.19 is vulnerable to Cross Site Scripting (XSS)

  Medium 5.4

• CVE-2021-36832

  WordPress Icegram plugin <= 2.0.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

  Medium 5.4

• CVE-2019-15830

  The icegram plugin before 1.10.29 for WordPress has ig_cat_list XSS.

  Medium 5.4

• CVE-2024-39625

  WordPress Icegram Engage plugin <= 3.1.24 - Unauthenticated Message Duplication Vulnerability

  Medium 5.3

• CVE-2024-43272

  WordPress Icegram Engage plugin <= 3.1.24 - Unauthenticated Unpublished Campaign Viewer vulnerability

  Medium 5.3