WordPress Plugin Vulnerabilities

Icegram Express < 5.8.6 - Admin+ Stored XSS

Description

The plugin does not properly escape a list description setting before outputting it within an HTML attribute, which could allow users with the Administrator role and above to perform Stored Cross-Site Scripting attacks.

Proof of Concept

Affects Plugins

Plugin icon
email-subscribers
Fixed in 5.8.6

References

CVE
CVE-2025-15692

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
3.5 (low)

Miscellaneous

Original Researcher
Dmitrii Ignatyev
Submitter
Dmitrii Ignatyev
Submitter website
https://www.linkedin.com/in/dmitriy-ignatyev-8a9189267/
Verified
Yes
WPVDB ID
263e7dc0-61bb-468e-9e15-a6b6789923f4

Timeline

Publicly Published
2026-09-01 (about 1 day ago)
Added
2026-09-01 (about 1 day ago)
Last Updated
2026-09-01 (about 1 day ago)

Other

Published
Title
Published
2007-06-15
Title
Andyblue < 20070607 - XSS
Published
2023-11-06
Title
Webpushr < 4.35.0 - Unauthenticated Stored XSS
Published
2015-04-20
Title
WP eCommerce <= 3.9.2 - Reflected Cross-Site Scripting (XSS)
Published
2025-01-29
Title
Alex Reservations: Smart Restaurant Booking < 2.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Published
2024-11-08
Title
Website remote Install vor Gravity, WPForms, Formidable, Ninja, Caldera <= 4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting