Cross-Site Scripting
12 records27.9%First: 2015. Latest: 2025.
Plugin security history
Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress Vulnerability History & Security Timeline
The Wordfence Intelligence dataset currently contains 43 vulnerability records associated with Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress, published between 2015 and 2026.
Dataset last synchronized: 2026-08-02 09:41:47 UTC
At a glance
Security Snapshot
43Total records
6Critical
7High
30Medium
0Low
0Informational
43Patched records
0Currently marked unpatched
2015-08-10First disclosure
2026-07-01Latest disclosure
42 of 43CVE coverage
Year-by-Year Timeline
| Year | Records | Relative volume |
|---|---|---|
| 2015 | 1 | |
| 2018 | 2 | |
| 2019 | 8 | |
| 2020 | 3 | |
| 2022 | 2 | |
| 2023 | 2 | |
| 2024 | 18 | |
| 2025 | 5 | |
| 2026 | 2 |
Severity Breakdown
| Severity | Records | Share |
|---|---|---|
| Critical | 6 | 14% |
| High | 7 | 16.3% |
| Medium | 30 | 69.8% |
Vulnerability-Type Breakdown
SQL Injection
11 records25.6%First: 2019. Latest: 2026.
Missing Authorization
10 records23.3%First: 2019. Latest: 2026.
Authentication Bypass
3 records7%First: 2019. Latest: 2025.
Other
3 records7%First: 2023. Latest: 2025.
CSRF
2 records4.7%First: 2019. Latest: 2020.
Information Disclosure
1 record2.3%First: 2018. Latest: 2018.
Path Traversal
1 record2.3%First: 2023. Latest: 2023.
Patch Status
- Patched
- 43
- Currently marked unpatched
- 0
- Unknown status
- 0
Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.
Latest Known Patched Versions
5.9.285.9.175.9.115.7.505.7.525.7.455.7.445.7.355.7.275.7.265.7.245.7.235.7.215.7.185.7.205.7.155.7.145.7.165.7.125.6.245.5.35.5.05.3.24.5.64.5.14.2.34.3.14.1.84.1.73.5.03.4.82.9.1
Affected-Version History
Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.
| Affected range | Vulnerability | Published | Patched version | Severity |
|---|---|---|---|---|
*-5.9.27 | Email Subscribers & Newsletters <= 5.9.27 - Missing Authorization to Authenticated (Contributor+) Settings Modification via ig_es_handle_request AJAX Action | July 1, 2026 | 5.9.28 | Medium |
*-5.9.16 | Email Subscribers & Newsletters <= 5.9.16 - Authenticated (Administrator+) SQL Injection via 'workflow_ids' Parameter | March 3, 2026 | 5.9.17 | Medium |
*-5.9.10 | Email Subscribers & Newsletters <= 5.9.10 - Missing Authentication to Unauthenticated Action Scheduler Task Execution | December 11, 2025 | 5.9.11 | Medium |
*-5.9.10 | Email Subscribers & Newsletters <= 5.9.10 - Missing Authentication to Unauthenticated Mailing Queue Trigger | November 18, 2025 | 5.9.11 | Medium |
*-5.9.10 | Email Subscribers & Newsletters <= 5.9.10 - Authenticated (Administrator+) PHP Object Injection | November 8, 2025 | 5.9.11 | Medium |
*-5.7.49 | Email Subscribers & Newsletters <= 5.7.49 - Authenticated (Administrator+) Stored Cross-Site Scripting | April 3, 2025 | 5.7.50 | Medium |
*-5.7.51 | Email Subscribers & Newsletters <= 5.7.51 - Authenticated (Administrator+) Stored Cross-Site Scripting | March 27, 2025 | 5.7.52 | Medium |
*-5.7.44 | Email Subscribers by Icegram Express – Affordable, Powerful Email Marketing for WordPress & WooCommerce <= 5.7.44 - Authenticated (Admin+) Stored Cross-Site Scripting via Text Block | December 23, 2024 | 5.7.45 | Medium |
*-5.7.44 | Email Subscribers by Icegram Express – Affordable, Powerful Email Marketing for WordPress & WooCommerce <= 5.7.44 - Authenticated (Admin+) Stored Cross-Site Scripting | December 23, 2024 | 5.7.45 | Medium |
*-5.7.44 | Email Subscribers by Icegram Express – Affordable, Powerful Email Marketing for WordPress & WooCommerce <= 5.7.44 - Authenticated (Admin+) Stored Cross-Site Scripting via Workflow Settings | December 23, 2024 | 5.7.45 | Medium |
*-5.7.44 | Email Subscribers by Icegram Express – Affordable, Powerful Email Marketing for WordPress & WooCommerce <= 5.7.44 - Authenticated (Admin+) Stored Cross-Site Scripting via Form Settings | December 23, 2024 | 5.7.45 | Medium |
*-5.7.43 | Email Subscribers by Icegram Express – Affordable, Powerful Email Marketing for WordPress & WooCommerce <= 5.7.43 - Authenticated (Admin+) SQL Injection | December 16, 2024 | 5.7.44 | Medium |
*-5.7.34 | Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.34 - Authenticated (Subscriber+) Arbitrary Shortcode Execution | October 1, 2024 | 5.7.35 | Medium |
*-5.7.34 | Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.34 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure | September 25, 2024 | 5.7.35 | Medium |
*-5.7.26 | Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.26 - Missing Authorization | July 16, 2024 | 5.7.27 | Medium |
*-5.7.25 | Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.25 - Unauthenticated SQL Injection via unsubscribe | July 1, 2024 | 5.7.26 | Critical |
*-5.7.23 | Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.23 - Unauthenticated SQL Injection via optin | June 20, 2024 | 5.7.24 | Critical |
*-5.7.22 | Icegram Express <= 5.7.22 - Authenticated (Subscriber+) SQL Injection Vulnerability via options[list_id] | June 11, 2024 | 5.7.23 | High |
*-5.7.20 | Email Subscribers by Icegram Express <= 5.7.20 - Unauthenticated SQL Injection via hash | June 4, 2024 | 5.7.21 | Critical |
*-5.7.17 | Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.17 - Missing Authorization | May 22, 2024 | 5.7.18 | Medium |
*-5.7.19 | Email Subscribers by Icegram Express <= 5.7.19 - Missing Authorization in handle_ajax_request | May 14, 2024 | 5.7.20 | High |
*-5.7.14 | Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.14 - Unauthenticated SQL Injection | April 15, 2024 | 5.7.15 | Critical |
*-5.7.13 | Email Subscribers & Newsletters <= 5.7.13 - Missing Authorization | April 5, 2024 | 5.7.14 | Medium |
*-5.7.15 | Icegram Express <= 5.7.14 - Authenticated (Administrator+) Cross-Site Scripting via CSV import | April 5, 2024 | 5.7.16 | Medium |
*-5.7.11 | Email Subscribers & Newsletters <= 5.7.11 - Reflected Cross-Site Scripting via campaign_id | March 26, 2024 | 5.7.12 | Medium |
Selected source records
Latest Records
MediumCVE-2026-11592
Email Subscribers & Newsletters <= 5.9.27 - Missing Authorization to Authenticated (Contributor+) Settings Modification via ig_es_handle_request AJAX Action
Published: July 1, 2026
- Affected versions
- *-5.9.27
- Patched versions
- 5.9.28
MediumCVE-2026-1651
Email Subscribers & Newsletters <= 5.9.16 - Authenticated (Administrator+) SQL Injection via 'workflow_ids' Parameter
Published: March 3, 2026
- Affected versions
- *-5.9.16
- Patched versions
- 5.9.17
MediumCVE-2025-12348
Email Subscribers & Newsletters <= 5.9.10 - Missing Authentication to Unauthenticated Action Scheduler Task Execution
Published: December 11, 2025
- Affected versions
- *-5.9.10
- Patched versions
- 5.9.11
MediumCVE-2025-12349
Email Subscribers & Newsletters <= 5.9.10 - Missing Authentication to Unauthenticated Mailing Queue Trigger
Published: November 18, 2025
- Affected versions
- *-5.9.10
- Patched versions
- 5.9.11
MediumCVE-2025-66055
Email Subscribers & Newsletters <= 5.9.10 - Authenticated (Administrator+) PHP Object Injection
Published: November 8, 2025
- Affected versions
- *-5.9.10
- Patched versions
- 5.9.11
MediumCVE-2025-0671
Email Subscribers & Newsletters <= 5.7.49 - Authenticated (Administrator+) Stored Cross-Site Scripting
Published: April 3, 2025
- Affected versions
- *-5.7.49
- Patched versions
- 5.7.50
MediumCVE-2024-11924
Email Subscribers & Newsletters <= 5.7.51 - Authenticated (Administrator+) Stored Cross-Site Scripting
Published: March 27, 2025
- Affected versions
- *-5.7.51
- Patched versions
- 5.7.52
MediumCVE-2024-12567
Email Subscribers by Icegram Express – Affordable, Powerful Email Marketing for WordPress & WooCommerce <= 5.7.44 - Authenticated (Admin+) Stored Cross-Site Scripting via Form Settings
Published: December 23, 2024
- Affected versions
- *-5.7.44
- Patched versions
- 5.7.45
Highest-Severity Records
CriticalCVE-2024-6172
Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.25 - Unauthenticated SQL Injection via unsubscribe
Published: July 1, 2024
- Affected versions
- *-5.7.25
- Patched versions
- 5.7.26
CriticalCVE-2019-13569
Email Subscribers & Newsletters <= 4.1.7 - SQL Injection
Published: July 22, 2019
- Affected versions
- *-4.1.7
- Patched versions
- 4.1.8
CriticalCVE-2024-4295
Email Subscribers by Icegram Express <= 5.7.20 - Unauthenticated SQL Injection via hash
Published: June 4, 2024
- Affected versions
- *-5.7.20
- Patched versions
- 5.7.21
CriticalCVE-2024-5756
Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.23 - Unauthenticated SQL Injection via optin
Published: June 20, 2024
- Affected versions
- *-5.7.23
- Patched versions
- 5.7.24
CriticalCVE-2024-2876
Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.14 - Unauthenticated SQL Injection
Published: April 15, 2024
- Affected versions
- *-5.7.14
- Patched versions
- 5.7.15
CriticalCVE-2023-5414
Icegram Express <= 5.6.23 - Authenticated (Administrator+) Directory Traversal to Arbitrary File Read
Published: October 11, 2023
- Affected versions
- *-5.6.23
- Patched versions
- 5.6.24
HighCVE-2024-4845
Icegram Express <= 5.7.22 - Authenticated (Subscriber+) SQL Injection Vulnerability via options[list_id]
Published: June 11, 2024
- Affected versions
- *-5.7.22
- Patched versions
- 5.7.23
HighCVE-2024-4010
Email Subscribers by Icegram Express <= 5.7.19 - Missing Authorization in handle_ajax_request
Published: May 14, 2024
- Affected versions
- *-5.7.19
- Patched versions
- 5.7.20
Need help reviewing an exposed WordPress website?
Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.
Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.
Data Source, Attribution and Methodology
This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.