← WordPress Vulnerabilities
WordPress security by component

Icegram

Icegram is a WordPress component with 13 published CVE records in this archive. The latest tracked vulnerability was published Jan 22, 2026; the highest CVE/CNA score is 6.5.

Plugin slug: icegram

CVE-2025-68507: Icegram: A security weakness

Icegram is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

PublishedJan 22, 2026
Safe version guidanceSee mitigation notes
Safe version
Jan 22, 2026 CVE-2025-68507
Icegram: A security weakness
Icegram is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
See mitigation notes
CVE6.5
NVDPending
Jan 24, 2025 CVE-2025-24542
Icegram: Cross-site scripting
Icegram is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
See mitigation notes
CVE6.5
NVDPending
Nov 01, 2024 CVE-2024-39625
Icegram: A security weakness
Icegram is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
See mitigation notes
CVE5.3
NVDPending
Aug 19, 2024 CVE-2024-43272
Icegram: A security weakness
Icegram is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
See mitigation notes
CVE5.3
NVDPending
Aug 18, 2024 CVE-2024-43344
Icegram: Cross-site scripting
Icegram is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
See mitigation notes
CVE6.5
NVDPending
Jun 08, 2024 CVE-2024-21748
Icegram: A security weakness
Icegram is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
See mitigation notes
CVE4.3
NVD5.4
Feb 01, 2024 CVE-2023-51532
Icegram Engage – WordPress Lead Generation, Popup Builder, CTA, Optins and Email List Building: Cross-site scripting
Icegram Engage – WordPress Lead Generation, Popup Builder, CTA, Optins and Email List Building is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
See mitigation notes
CVE6.5
NVD5.4
Jan 05, 2024 CVE-2023-52119
Icegram Engage – WordPress Lead Generation, Popup Builder, CTA, Optins and Email List Building: Cross-site request forgery
Icegram Engage – WordPress Lead Generation, Popup Builder, CTA, Optins and Email List Building is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.
See mitigation notes
CVE4.3
NVD8.8
Dec 21, 2021 CVE-2021-24941
Popups, Welcome Bar, Optins and Lead Generation Plugin: Cross-site scripting
Popups, Welcome Bar, Optins and Lead Generation Plugin is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
See mitigation notes
CVE6.1
NVD6.1
Oct 19, 2021 CVE-2021-36832
Icegram: A security weakness
Icegram is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
See mitigation notes
CVE4.8
NVD5.4
Sep 16, 2019 CVE-2016-10963
Icegram: Cross-site scripting
Icegram is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
See mitigation notes
CVE6.1
NVD6.1
Sep 16, 2019 CVE-2016-10962
Icegram: Cross-site request forgery
Icegram is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.
See mitigation notes
CVE6.5
NVD6.5
Aug 30, 2019 CVE-2019-15830
Icegram: Cross-site scripting
Icegram is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
See mitigation notes
CVE5.4
NVD5.4