| CVE-2024-8254 | Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.34 - Authenticated (Subscriber+) Arbitrary Shortcode Execution | icegram | Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress | Medium | 5.4 | 2024-10-02 06:46:02 | Deep Dive |
| CVE-2024-8771 | Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.34 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure | icegram | Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress | Medium | 4.3 | 2024-09-26 15:30:34 | Deep Dive |
| CVE-2024-7054 | Popup Maker <= 1.19.0 - Authenticated (Contributor+) Stored Cross-Site Scripting | danieliser | Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder | Medium | 6.4 | 2024-08-20 10:58:30 | Deep Dive |
| CVE-2024-5703 | Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.26 - Missing Authorization | icegram | Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress | Medium | 4.3 | 2024-07-17 07:32:19 | Deep Dive |
| CVE-2024-6172 | Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.25 - Unauthenticated SQL Injection via unsubscribe | icegram | Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress | Critical | 9.8 | 2024-07-02 06:49:43 | Deep Dive |
| CVE-2024-37252 | WordPress Email Subscribers by Icegram Express plugin <= 5.7.25 - SQL Injection vulnerability | Icegram | Email Subscribers & Newsletters | Critical | 9.3 | 2024-06-26 10:13:48 | Deep Dive |
| CVE-2024-5756 | Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.23 - Unauthenticated SQL Injection via optin | icegram | Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress | Critical | 9.8 | 2024-06-21 04:34:11 | Deep Dive |
| CVE-2024-3961 | ConvertKit <= 2.4.9 - Missing Authorization | convertkit | Kit (formerly ConvertKit) – Email Newsletter, Email Marketing, Membership, Subscribers and Landing Pages | Medium | 5.3 | 2024-06-21 03:49:00 | Deep Dive |
| CVE-2024-4845 | Icegram Express <= 5.7.22 - Authenticated (Subscriber+) SQL Injection Vulnerability via options[list_id] | icegram | Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress | High | 8.8 | 2024-06-12 09:33:12 | Deep Dive |
| CVE-2024-31352 | WordPress Icegram Express plugin <= 5.7.13 - Broken Access Control vulnerability | - | Email Subscribers & Newsletters | Medium | 5.3 | 2024-06-09 17:23:55 | Deep Dive |
| CVE-2024-4295 | Email Subscribers by Icegram Express <= 5.7.20 - Unauthenticated SQL Injection via hash | icegram | Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress | Critical | 9.8 | 2024-06-05 05:33:06 | Deep Dive |
| CVE-2024-3626 | Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.17 - Missing Authorization | icegram | Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress | Medium | 4.3 | 2024-05-23 05:32:15 | Deep Dive |
| CVE-2024-4010 | Email Subscribers by Icegram Express <= 5.7.19 - Missing Authorization in handle_ajax_request | icegram | Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress | High | 8.8 | 2024-05-15 08:34:13 | Deep Dive |
| CVE-2024-2876 | Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.14 - Unauthenticated SQL Injection | icegram | Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress | Critical | 9.8 | 2024-05-02 16:52:46 | Deep Dive |
| CVE-2024-2656 | Icegram Express <= 5.7.14 - Authenticated (Administrator+) Cross-Site Scripting via CSV import | icegram | Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress | Medium | 4.4 | 2024-04-06 03:24:43 | Deep Dive |
| CVE-2024-22300 | WordPress Icegram Express plugin <= 5.7.11 - Reflected Cross Site Scripting (XSS) vulnerability | Icegram | Email Subscribers & Newsletters | High | 7.1 | 2024-03-27 05:56:52 | Deep Dive |
| CVE-2024-1935 | Giveaways and Contests by RafflePress <= 1.12.5 - Unauthenticated Stored Cross-Site Scripting | smub | Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers | High | 7.2 | 2024-03-13 15:26:40 | Deep Dive |
| CVE-2023-41735 | WordPress Email posts to subscribers Plugin <= 6.2 is vulnerable to Sensitive Data Exposure | Gopi Ramasamy | Email posts to subscribers | Medium | 5.3 | 2023-11-30 14:54:11 | Deep Dive |
| CVE-2022-46818 | WordPress Email posts to subscribers Plugin <= 6.2 is vulnerable to SQL Injection | Gopi Ramasamy | Email posts to subscribers | High | 8.2 | 2023-11-03 15:58:24 | Deep Dive |
| CVE-2023-5049 | Giveaways and Contests by RafflePress <= 1.12.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode | smub | Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers | Medium | 6.4 | 2023-10-30 13:49:00 | Deep Dive |