WordPress Icegram Plugin <= 3.1.24 is vulnerable to Broken Access Control

Software Icegram Type Plugin Vulnerable versions = 3.1.24 Fixed in 3.1.25 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-43272 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 1aae66c653f7 Credits Dhabaleshwar Das Required privilege...

WordPress Icegram Collect – Easy Form, Lead Collection and Subscription plugin Plugin <= 1.3.14 is vulnerable to Broken Access Control

Software Icegram Collect – Easy Form, Lead Collection and Subscription plugin Type Plugin Vulnerable versions = 1.3.14 Fixed in 1.3.15 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-43273 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership...

WordPress Icegram Engage plugin <= 3.1.24 - Unauthenticated Message Duplication Vulnerability

Unauthenticated Message Duplication Vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Plugin Icegram versions = 3.1.24...

WordPress Icegram Plugin <= 3.1.24 is vulnerable to Broken Access Control

Software Icegram Type Plugin Vulnerable versions = 3.1.24 Fixed in 3.1.25 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-39625 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 8700bcf08e02 Credits Dhabaleshwar Das Required privilege...

CVE-2024-5703

The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthorized API access due to a missing capability check in all versions up to, and including, 5.7.26. This makes it possible for authenticated...

CVE-2024-5703 Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.26 - Missing Authorization

The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthorized API access due to a missing capability check in all versions up to, and including, 5.7.26. This makes it possible for authenticated...

CVE-2024-5703

The CVE CVE-2024-5703 affects the WordPress plugin Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce (versions up to 5.7.26). The issue is a missing capability check that permits unauthorized API access to the plugin’s API (if enabled) by ...

WordPress Icegram Express plugin <= 5.7.26 - Missing Authorization vulnerability

Missing Authorization vulnerability discovered by Arkadiusz Hydzik in WordPress Plugin Email Subscribers & Newsletters versions = 5.7.26...

CVE-2024-6172

The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the db parameter in all versions up to, and including, 5.7.25 due to insufficient escaping on the user supplied...

CVE-2024-6172

CVE-2024-6172 affects the Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin. Root cause: insufficient escaping and inadequate query preparation on the db parameter; enables time-based SQL injection. Affected versions: all up to 5.7....

PT-2024-37432

Name of the Vulnerable Software and Affected Versions: Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin versions up to, and including, 5.7.25 Description: The issue allows unauthenticated attackers to perform time-based SQL Injecti...

WordPress plugin Email Subscribers by Icegram Express Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation, a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on servers running PHP and MySQL. A security vulnerability exists in the WordPress plugin...

CVE-2024-37252

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Icegram Email Subscribers & Newsletters allows SQL Injection.This issue affects Email Subscribers & Newsletters: from n/a through 5.7.25...

CVE-2024-37252 WordPress Email Subscribers by Icegram Express plugin <= 5.7.25 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Icegram Email Subscribers & Newsletters allows SQL Injection.This issue affects Email Subscribers & Newsletters: from n/a through 5.7.25...

CVE-2024-37252 WordPress Email Subscribers by Icegram Express plugin <= 5.7.25 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Icegram Email Subscribers & Newsletters allows SQL Injection.This issue affects Email Subscribers & Newsletters: from n/a through 5.7.25...

CVE-2024-37252

CVE-2024-37252 affects WordPress Email Subscribers by Icegram Express plugin (

WordPress Email Subscribers by Icegram Express plugin <= 5.7.25 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by shaman0x01 Patchstack Alliance in WordPress Plugin Email Subscribers & Newsletters versions = 5.7.25...

CVE-2024-5756

The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the db parameter in all versions up to, and including, 5.7.23 due to insufficient escaping on the user supplied...

CVE-2024-5756

The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the db parameter in all versions up to, and including, 5.7.23 due to insufficient escaping on the user supplied...

CVE-2024-5756

CVE-2024-5756 affects Email Subscribers by Icegram Express – Email Subscribers, Newsletters, Automation for WordPress & WooCommerce. Time-based SQL Injection via the db parameter exists in all versions up to 5.7.23 due to insufficient escaping and query preparation, enabling unauthenticated attac...