CVE-2024-2656mediumCWE-79

CVE-2024-2656: medium-severity vulnerability in icegram Email Subscribers & Newsletters…

Icegram Express <= 5.7.14 - Authenticated (Administrator+) Cross-Site Scripting via CSV import

Published · Updated

Follow this CVE+ Monitor Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.4epss 0.3%
The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a CSV import in all versions up to, and including, 5.7.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
Affected products
icegram · Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress
Related CVEs — icegram Email Subscribers & Newsletters…

In the same product, most dangerous first.

CVE-2024-2876CRITICALIcegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.14 - Unauthenticated SQL InjectionEPSS 80.6%CVE-2024-4295CRITICALEmail Subscribers by Icegram Express <= 5.7.20 - Unauthenticated SQL Injection via hashEPSS 10.2%CVE-2023-5414CRITICALIcegram Express <= 5.6.23 - Authenticated (Administrator+) Directory Traversal to Arbitrary File ReadEPSS 1.3%CVE-2024-6172CRITICALEmail Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.25 - Unauthenticated SQL Injection via unsubscribeEPSS 1.1%CVE-2024-5756CRITICALIcegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.23 - Unauthenticated SQL Injection via optinEPSS 0.7%CVE-2026-12757MEDIUMEmail Subscribers & Newsletters <= 5.9.27 - Unauthenticated Arbitrary Shortcode Execution via Subscriber Name FieldEPSS 0.6%