CVE-2023-5414criticalCWE-22

CVE-2023-5414: critical vulnerability in icegram Email Subscribers & Newsletters…

Icegram Express <= 5.6.23 - Authenticated (Administrator+) Directory Traversal to Arbitrary File Read

Published · Updated

Follow this CVE+ Monitor Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.1epss 1.3%
The Icegram Express plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 5.6.23 via the show_es_logs function. This allows administrator-level attackers to read the contents of arbitrary files on the server, which can contain sensitive information including those belonging to other sites, for example in shared hosting environments.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Affected products
icegram · Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress
Related CVEs — icegram Email Subscribers & Newsletters…

In the same product, most dangerous first.

CVE-2024-2876CRITICALIcegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.14 - Unauthenticated SQL InjectionEPSS 80.6%CVE-2024-4295CRITICALEmail Subscribers by Icegram Express <= 5.7.20 - Unauthenticated SQL Injection via hashEPSS 10.2%CVE-2024-6172CRITICALEmail Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.25 - Unauthenticated SQL Injection via unsubscribeEPSS 1.1%CVE-2024-5756CRITICALIcegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.23 - Unauthenticated SQL Injection via optinEPSS 0.7%CVE-2026-12757MEDIUMEmail Subscribers & Newsletters <= 5.9.27 - Unauthenticated Arbitrary Shortcode Execution via Subscriber Name FieldEPSS 0.6%CVE-2024-8254MEDIUMEmail Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.34 - Authenticated (Subscriber+) Arbitrary Shortcode ExecutionEPSS 0.5%