Plugin icon

Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress

email-subscribers

Vulnerabilities:

39

Last Updated:

March 5, 2026

Active Installs:

60000

Published
Title
Fixed in
CVSS
Published
2026-03-03
Title
Email Subscribers & Newsletters < 5.9.17 - Authenticated (Administrator+) SQL Injection via 'workflow_ids' Parameter
Fixed in
Fixed in 5.9.17
CVSS
6.5 (medium)
Published
2025-12-11
Title
Email Subscribers & Newsletters < 5.9.11 - Unauthenticated Action Scheduler Task Execution
Fixed in
Fixed in 5.9.11
CVSS
5.3 (medium)
Published
2025-11-18
Title
Email Subscribers & Newsletters < 5.9.11 - Unauthenticated Mailing Queue Trigger
Fixed in
Fixed in 5.9.11
CVSS
5.3 (medium)
Published
2025-11-08
Title
Email Subscribers & Newsletters < 5.9.11 - Authenticated (Administrator+) PHP Object Injection
Fixed in
Fixed in 5.9.11
CVSS
6.6 (medium)
Published
2025-04-03
Title
Email Subscribers < 5.7.50 - Admin+ Stored XSS in Template
Fixed in
Fixed in 5.7.50
CVSS
3.5 (low)
Published
2025-03-27
Title
Email Subscribers < 5.7.52 - Admin+ Stored XSS
Fixed in
Fixed in 5.7.52
CVSS
3.5 (low)
Published
2024-12-23
Title
Email Subscribers < 5.7.45 - Admin+ Stored XSS
Fixed in
Fixed in 5.7.45
CVSS
3.5 (low)
Published
2024-12-23
Title
Email Subscribers < 5.7.45 - Admin+ Stored XSS
Fixed in
Fixed in 5.7.45
CVSS
3.5 (low)
Published
2024-12-23
Title
Email Subscribers < 5.7.45 - Admin+ Stored XSS
Fixed in
Fixed in 5.7.45
CVSS
3.5 (low)
Published
2024-12-23
Title
Email Subscribers < 5.7.45 - Admin+ Stored XSS
Fixed in
Fixed in 5.7.45
CVSS
3.5 (low)
Published
2024-12-16
Title
Email Subscribers < 5.7.44 - Admin+ SQL Injection
Fixed in
Fixed in 5.7.44
CVSS
4.1 (medium)
Published
2024-10-01
Title
Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce < 5.7.35 - Authenticated (Subscriber+) Arbitrary Shortcode Execution
Fixed in
Fixed in 5.7.35
CVSS
5.4 (medium)
Published
2024-09-25
Title
Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce < 5.7.35 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure
Fixed in
Fixed in 5.7.35
CVSS
4.3 (medium)
Published
2024-07-16
Title
Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin < 5.7.27 - Missing Authorization
Fixed in
Fixed in 5.7.27
CVSS
4.3 (medium)
Published
2024-07-01
Title
Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce < 5.7.26 - Unauthenticated SQL Injection via unsubscribe
Fixed in
Fixed in 5.7.26
CVSS
9.8 (critical)
Published
2024-06-20
Title
Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin < 5.7.24 - Unauthenticated SQL Injection via optin
Fixed in
Fixed in 5.7.24
CVSS
9.8 (critical)
Published
2024-06-11
Title
Icegram Express < 5.7.23 - Authenticated (Subscriber+) SQL Injection Vulnerability via options[list_id]
Fixed in
Fixed in 5.7.23
CVSS
8.8 (high)
Published
2024-06-04
Title
Email Subscribers by Icegram Express < 5.7.21 - Unauthenticated SQL Injection via hash
Fixed in
Fixed in 5.7.21
CVSS
9.8 (critical)
Published
2024-05-22
Title
Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce < 5.7.18 - Missing Authorization
Fixed in
Fixed in 5.7.18
CVSS
4.3 (medium)
Published
2024-05-14
Title
Email Subscribers by Icegram Express < 5.7.20 - Missing Authorization in handle_ajax_request
Fixed in
Fixed in 5.7.20
CVSS
8.8 (high)
Published
2024-04-15
Title
Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin < 5.7.15 - Unauthenticated SQL Injection
Fixed in
Fixed in 5.7.15
CVSS
9.8 (critical)
Published
2024-04-05
Title
Email Subscribers & Newsletters < 5.7.14 - Missing Authorization
Fixed in
Fixed in 5.7.14
CVSS
5.3 (medium)
Published
2024-04-05
Title
Icegram Express < 5.7.16 - Authenticated (Administrator+) Cross-Site Scripting via CSV import
Fixed in
Fixed in 5.7.16
CVSS
4.4 (medium)
Published
2024-03-26
Title
Email Subscribers & Newsletters < 5.7.12 - Reflected Cross-Site Scripting via campaign_id
Fixed in
Fixed in 5.7.12
CVSS
6.1 (medium)
Published
2023-10-11
Title
Icegram Express < 5.6.24 - Admin+ Directory Traversal
Fixed in
Fixed in 5.6.24
CVSS
9.1 (critical)
Published
2023-02-06
Title
Email Subscribers & Newsletters < 5.5.3 - Improper Neutralization of Formula Elements in a CSV File
Fixed in
Fixed in 5.5.3
CVSS
6.5 (medium)
Published
2022-11-21
Title
Icegram Express < 5.5.1 - Subscriber+ SQLi
Fixed in
Fixed in 5.5.1
CVSS
7.7 (high)
Published
2022-02-11
Title
Email Subscribers & Newsletters < 5.3.2 - Subscriber+ Blind SQL injection
Fixed in
Fixed in 5.3.2
CVSS
7.7 (high)
Published
2022-02-11
Title
Email Subscribers & Newsletters < 5.3.2 - Unauthenticated arbitrary option update
Fixed in
Fixed in 5.3.2
CVSS
8.2 (high)
Published
2020-09-10
Title
Email Subscribers & Newsletters < 4.5.6 - Unauthenticated email forgery/spoofing
Fixed in
Fixed in 4.5.6
CVSS
7.5 (high)
Published
2020-07-18
Title
Email Subscribers & Newsletters < 4.5.1 - Authenticated SQL injection in es_newsletters_settings_callback()
Fixed in
Fixed in 4.5.1
CVSS
6.7 (medium)
Published
2020-07-18
Title
Email Subscribers & Newsletters < 4.5.1 - Cross-site Request Forgery in send_test_email()
Fixed in
Fixed in 4.5.1
CVSS
3.1 (low)
Published
2019-11-13
Title
Email Subscribers & Newsletters < 4.2.3 - Multiple Issues
Fixed in
Fixed in 4.2.3
CVSS
8.3 (high)
Published
2019-11-13
Title
Email Subscribers & Newsletters < 4.3.1 - Unauthenticated Blind SQL Injection
Fixed in
Fixed in 4.3.1
CVSS
9.1 (critical)
Published
2019-07-22
Title
Email Subscribers & Newsletters < 4.1.8 - SQL Injection
Fixed in
Fixed in 4.1.8
CVSS
8.3 (high)
Published
2019-07-12
Title
Email Subscribers & Newsletters < 4.1.7 - Cross-Site Scripting (XSS)
Fixed in
Fixed in 4.1.7
CVSS
9.6 (critical)
Published
2018-05-28
Title
Email Subscribers & Newsletters < 3.5.0 - Cross-Site Scripting (XSS)
Fixed in
Fixed in 3.5.0
CVSS
6.1 (medium)
Published
2018-01-24
Title
Email Subscribers & Newsletters < 3.4.8 - Unauthenticated Subscriber Download
Fixed in
Fixed in 3.4.8
CVSS
7.5 (high)
Published
2015-08-10
Title
Email Subscribers & Newsletters < 2.9.1 - Multiple XSS & SQLi
Fixed in
Fixed in 2.9.1
CVSS
6.7 (medium)