# icegram Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress.

Every CVE that names icegram Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Email Subscribers & Newsletters <= 5.9.27 - Unauthenticated Arbitrary Shortcode Execution via Subscriber Name Field](https://agentprime.io/advisories/CVE-2026-12757.md)
  `CVE-2026-12757` · CVE record: icegram Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress · CVSS 6.5 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Code injection
- [Email Subscribers & Newsletters <= 5.9.16 - Authenticated (Administrator+) SQL Injection via 'workflow_ids' Parameter](https://agentprime.io/advisories/CVE-2026-1651.md)
  `CVE-2026-1651` · CVE record: icegram Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress · CVSS 6.5 Medium · Not analysed yet · Published 4 Mar 2026 · Tags: SQL injection
- [Email Subscribers & Newsletters <= 5.9.10 - Missing Authentication to Unauthenticated Action Scheduler Task Execution](https://agentprime.io/advisories/CVE-2025-12348.md)
  `CVE-2025-12348` · CVE record: icegram Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress · CVSS 5.3 Medium · Not analysed yet · Published 12 Dec 2025 · Tags: Authentication bypass
- [Email Subscribers & Newsletters <= 5.9.10 - Missing Authentication to Unauthenticated Mailing Queue Trigger](https://agentprime.io/advisories/CVE-2025-12349.md)
  `CVE-2025-12349` · CVE record: icegram Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress · CVSS 5.3 Medium · Not analysed yet · Published 19 Nov 2025 · Tags: Authentication bypass
- [Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.34 - Authenticated (Subscriber+) Arbitrary Shortcode Execution](https://agentprime.io/advisories/CVE-2024-8254.md)
  `CVE-2024-8254` · CVE record: icegram Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress · CVSS 5.4 Medium · Not analysed yet · Published 2 Oct 2024 · Tags: Code injection
- [Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.34 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Expo…](https://agentprime.io/advisories/CVE-2024-8771.md)
  `CVE-2024-8771` · CVE record: icegram Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress · CVSS 4.3 Medium · Not analysed yet · Published 26 Sept 2024 · Tags: Broken access control
- [Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.26 - Missing Authorization](https://agentprime.io/advisories/CVE-2024-5703.md)
  `CVE-2024-5703` · CVE record: icegram Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress · CVSS 4.3 Medium · Not analysed yet · Published 17 Jul 2024 · Tags: Broken access control
- [Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.25 - Unauthenticated SQL Injection via unsubscribe](https://agentprime.io/advisories/CVE-2024-6172.md)
  `CVE-2024-6172` · CVE record: icegram Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Jul 2024 · Tags: SQL injection
- [Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.23 - Unauthenticated SQL Injection via optin](https://agentprime.io/advisories/CVE-2024-5756.md)
  `CVE-2024-5756` · CVE record: icegram Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Jun 2024 · Tags: SQL injection
- [Icegram Express <= 5.7.22 - Authenticated (Subscriber+) SQL Injection Vulnerability via options\[list_id\]](https://agentprime.io/advisories/CVE-2024-4845.md)
  `CVE-2024-4845` · CVE record: icegram Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress · CVSS 8.8 High · Not analysed yet · Published 12 Jun 2024 · Tags: SQL injection
- [Email Subscribers by Icegram Express <= 5.7.20 - Unauthenticated SQL Injection via hash](https://agentprime.io/advisories/CVE-2024-4295.md)
  `CVE-2024-4295` · CVE record: icegram Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.10 · Not analysed yet · Published 5 Jun 2024 · Tags: SQL injection
- [Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.17 - Missing Authorization](https://agentprime.io/advisories/CVE-2024-3626.md)
  `CVE-2024-3626` · CVE record: icegram Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress · CVSS 4.3 Medium · Not analysed yet · Published 23 May 2024 · Tags: Broken access control
- [Email Subscribers by Icegram Express <= 5.7.19 - Missing Authorization in handle_ajax_request](https://agentprime.io/advisories/CVE-2024-4010.md)
  `CVE-2024-4010` · CVE record: icegram Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress · CVSS 8.8 High · Not analysed yet · Published 15 May 2024 · Tags: Broken access control
- [Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.14 - Unauthenticated SQL Injection](https://agentprime.io/advisories/CVE-2024-2876.md)
  `CVE-2024-2876` · CVE record: icegram Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.81 · Not analysed yet · Published 2 May 2024 · Tags: SQL injection
- [Icegram Express <= 5.7.14 - Authenticated (Administrator+) Cross-Site Scripting via CSV import](https://agentprime.io/advisories/CVE-2024-2656.md)
  `CVE-2024-2656` · CVE record: icegram Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress · CVSS 4.4 Medium · Not analysed yet · Published 6 Apr 2024 · Tags: Cross-site scripting (XSS)
- [Icegram Express <= 5.6.23 - Authenticated (Administrator+) Directory Traversal to Arbitrary File Read](https://agentprime.io/advisories/CVE-2023-5414.md)
  `CVE-2023-5414` · CVE record: icegram Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2023 · Tags: Path traversal

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=icegram-email-subscribers-newsletters-email-marketing-post-notifications-newslet>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/icegram-email-subscribers-newsletters-email-marketing-post-notifications-newslet/>. Everything for agents: <https://agentprime.io/llms.txt>.