icegram Vulnerabilities and Affected Products
Vulnerabilities associated with Icegram Collect.
Products
Clear product- Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress16 vulnerabilities
- email_subscribers_\&_newsletters7 vulnerabilities
- Icegram6 vulnerabilities
- Email Subscribers & Newsletters4 vulnerabilities
- Icegram Collect3 vulnerabilities
- Icegram Engage – WordPress Lead Generation, Popup Builder, CTA, Optins and Email List Building2 vulnerabilities
- Icegram Express Pro2 vulnerabilities
- Icegram Engage – Popups, Optins, CTAs & Lead Generation1 vulnerability
- Icegram Express – Email Marketing, Newsletters and Automation for WordPress & WooCommerce1 vulnerability
- Icegram Mailer – Reliable Email Deliverability, No-code SMTP Replacement & Email logs1 vulnerability
- icegram_express1 vulnerability
- Popups, Welcome Bar, Optins and Lead Generation Plugin – Icegram1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2025-47527HIGH | WordPress Icegram Collect – Easy Form, Lead Collection and Subscription plugin <= 1.3.18 - Broken Access Control VulnerabilityMissing Authorization vulnerability in Icegram Icegram Collect icegram-rainmaker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Icegram Collect: from n/a through <= 1.3.18. CWE-862Jun 9, 2025 | CVSS7.1v3.1 | EPSS0.294% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-43273MEDIUM | WordPress Icegram Collect plugin <= 1.3.14 - Broken Access Control vulnerabilityMissing Authorization vulnerability in icegram Icegram Collect plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Icegram Collect plugin: from n/a through 1.3.14. CWE-862Nov 1, 2024 | CVSS5.4v3.1 | EPSS0.41% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-25024MEDIUM | WordPress Icegram Collect plugin <= 1.3.8 is vulnerable to Cross Site Scripting (XSS)Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Icegram Icegram Collect plugin <= 1.3.8 versions. CWE-79Apr 7, 2023 | CVSS5.9v3.1 | EPSS0.394% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |