Plugin security history

Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 43 vulnerability records associated with Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress, published between 2015 and 2026.

Dataset last synchronized: 2026-08-02 09:41:47 UTC

At a glance

Security Snapshot

43Total records

6Critical

7High

30Medium

0Low

0Informational

43Patched records

0Currently marked unpatched

2015-08-10First disclosure

2026-07-01Latest disclosure

42 of 43CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2015	1	1 records
2018	2	2 records
2019	8	8 records
2020	3	3 records
2022	2	2 records
2023	2	2 records
2024	18	18 records
2025	5	5 records
2026	2	2 records

Severity Breakdown

Severity	Records	Share
Critical	6	14%
High	7	16.3%
Medium	30	69.8%

Vulnerability-Type Breakdown

Cross-Site Scripting

12 records27.9%

First: 2015. Latest: 2025.

SQL Injection

11 records25.6%

First: 2019. Latest: 2026.

Missing Authorization

10 records23.3%

First: 2019. Latest: 2026.

Authentication Bypass

3 records7%

First: 2019. Latest: 2025.

Other

3 records7%

First: 2023. Latest: 2025.

CSRF

2 records4.7%

First: 2019. Latest: 2020.

Information Disclosure

1 record2.3%

First: 2018. Latest: 2018.

Path Traversal

1 record2.3%

First: 2023. Latest: 2023.

Patch Status

Patched: 43
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

5.9.28
5.9.17
5.9.11
5.7.50
5.7.52
5.7.45
5.7.44
5.7.35
5.7.27
5.7.26
5.7.24
5.7.23
5.7.21
5.7.18
5.7.20
5.7.15
5.7.14
5.7.16
5.7.12
5.6.24
5.5.3
5.5.0
5.3.2
4.5.6
4.5.1
4.2.3
4.3.1
4.1.8
4.1.7
3.5.0
3.4.8
2.9.1

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-5.6.23`	Icegram Express <= 5.6.23 - Authenticated (Administrator+) Directory Traversal to Arbitrary File Read	October 11, 2023	5.6.24	Critical
`*-5.5.2`	Icegram Express <= 5.5.2 - Unauthenticated CSV Injection	February 6, 2023	5.5.3	Medium
`*-5.4.19`	Icegram Express <= 5.4.19 - Authenticated (Subscriber+) SQL Injection	November 21, 2022	5.5.0	High
`[*, 5.3.2)`	Email Subscribers & Newsletters <= 5.3.1 - Authenticated (or Cross-Site Request Forgery) Blind SQL Injection	February 11, 2022	5.3.2	High
`[*, 4.5.6)`	Email Subscribers & Newsletters <= 4.5.5 - Unauthenticated Email Forgery	September 9, 2020	4.5.6	Medium
`[*, 4.5.1)`	Icegram Email Subscribers & Newsletters <= 4.5.0 - Authenticated SQL Injection	July 16, 2020	4.5.1	Medium
`[*, 4.5.1)`	Icegram Email Subscribers & Newsletters Plugin for WordPress <= 4.5.0 - Cross-Site Request Forgery	July 13, 2020	4.5.1	High
`*-4.2.2`	Email Subscribers & Newsletters <= 4.2.2 - Unauthenticated Option Creation	November 13, 2019	4.2.3	Medium
`*-4.2.2`	Email Subscribers & Newsletters <= 4.2.2 - Cross-Site Request Forgery on Settings	November 13, 2019	4.2.3	Medium
`*-4.2.2`	Email Subscribers & Newsletters <= 4.2.2 - Unauthenticated File Download w/ Information Disclosure	November 13, 2019	4.2.3	Medium
`*-4.2.2`	Email Subscribers & Newsletters <= 4.2.2 - Missing Authorization to Test Email	November 13, 2019	4.2.3	Medium
`*-4.2.2`	Email Subscribers & Newsletters <= 4.2.2 - Missing Authorization	November 13, 2019	4.2.3	Medium
`*-4.3.0`	Email Subscribers & Newsletters < 4.3.1 - Unauthenticated Blind SQL Injection	November 13, 2019	4.3.1	High
`*-4.1.7`	Email Subscribers & Newsletters <= 4.1.7 - SQL Injection	July 22, 2019	4.1.8	Critical
`*-4.1.6`	Email Subscribers & Newsletters <= 4.1.6 - Cross-Site Scripting	July 12, 2019	4.1.7	Medium
`*-3.4.12`	Email Subscribers & Newsletters <= 3.4.12 - Cross-Site Scripting	May 28, 2018	3.5.0	Medium
`*-3.4.7`	Email Subscribers & Newsletters <= 3.4.7 - Unauthenticated Subscriber Download	January 24, 2018	3.4.8	High
`[*, 2.9.1)`	Email Subscribers & Newsletters < 2.9.1 - Cross-Site Scripting	August 10, 2015	2.9.1	Medium

Selected source records

Latest Records

MediumCVE-2026-11592

Email Subscribers & Newsletters <= 5.9.27 - Missing Authorization to Authenticated (Contributor+) Settings Modification via ig_es_handle_request AJAX Action

Published: July 1, 2026

Affected versions: *-5.9.27
Patched versions: 5.9.28

Original Wordfence record

MediumCVE-2026-1651

Email Subscribers & Newsletters <= 5.9.16 - Authenticated (Administrator+) SQL Injection via 'workflow_ids' Parameter

Published: March 3, 2026

Affected versions: *-5.9.16
Patched versions: 5.9.17

Original Wordfence record

MediumCVE-2025-12348

Email Subscribers & Newsletters <= 5.9.10 - Missing Authentication to Unauthenticated Action Scheduler Task Execution

Published: December 11, 2025

Affected versions: *-5.9.10
Patched versions: 5.9.11

Original Wordfence record

MediumCVE-2025-12349

Email Subscribers & Newsletters <= 5.9.10 - Missing Authentication to Unauthenticated Mailing Queue Trigger

Published: November 18, 2025

Affected versions: *-5.9.10
Patched versions: 5.9.11

Original Wordfence record

MediumCVE-2025-66055

Email Subscribers & Newsletters <= 5.9.10 - Authenticated (Administrator+) PHP Object Injection

Published: November 8, 2025

Affected versions: *-5.9.10
Patched versions: 5.9.11

Original Wordfence record

MediumCVE-2025-0671

Email Subscribers & Newsletters <= 5.7.49 - Authenticated (Administrator+) Stored Cross-Site Scripting

Published: April 3, 2025

Affected versions: *-5.7.49
Patched versions: 5.7.50

Original Wordfence record

MediumCVE-2024-11924

Email Subscribers & Newsletters <= 5.7.51 - Authenticated (Administrator+) Stored Cross-Site Scripting

Published: March 27, 2025

Affected versions: *-5.7.51
Patched versions: 5.7.52

Original Wordfence record

MediumCVE-2024-12567

Email Subscribers by Icegram Express – Affordable, Powerful Email Marketing for WordPress & WooCommerce <= 5.7.44 - Authenticated (Admin+) Stored Cross-Site Scripting via Form Settings

Published: December 23, 2024

Affected versions: *-5.7.44
Patched versions: 5.7.45

Original Wordfence record

Highest-Severity Records

CriticalCVE-2024-6172

Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.25 - Unauthenticated SQL Injection via unsubscribe

Published: July 1, 2024

Affected versions: *-5.7.25
Patched versions: 5.7.26

Original Wordfence record

CriticalCVE-2019-13569

Email Subscribers & Newsletters <= 4.1.7 - SQL Injection

Published: July 22, 2019

Affected versions: *-4.1.7
Patched versions: 4.1.8

Original Wordfence record

CriticalCVE-2024-4295

Email Subscribers by Icegram Express <= 5.7.20 - Unauthenticated SQL Injection via hash

Published: June 4, 2024

Affected versions: *-5.7.20
Patched versions: 5.7.21

Original Wordfence record

CriticalCVE-2024-5756

Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.23 - Unauthenticated SQL Injection via optin

Published: June 20, 2024

Affected versions: *-5.7.23
Patched versions: 5.7.24

Original Wordfence record

CriticalCVE-2024-2876

Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.14 - Unauthenticated SQL Injection

Published: April 15, 2024

Affected versions: *-5.7.14
Patched versions: 5.7.15

Original Wordfence record

CriticalCVE-2023-5414

Icegram Express <= 5.6.23 - Authenticated (Administrator+) Directory Traversal to Arbitrary File Read

Published: October 11, 2023

Affected versions: *-5.6.23
Patched versions: 5.6.24

Original Wordfence record

HighCVE-2024-4845

Icegram Express <= 5.7.22 - Authenticated (Subscriber+) SQL Injection Vulnerability via options[list_id]

Published: June 11, 2024

Affected versions: *-5.7.22
Patched versions: 5.7.23

Original Wordfence record

HighCVE-2024-4010

Email Subscribers by Icegram Express <= 5.7.19 - Missing Authorization in handle_ajax_request

Published: May 14, 2024

Affected versions: *-5.7.19
Patched versions: 5.7.20

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory