Is Icegram Engage safe?

Every recorded flaw

• Oct 1, 2026Contributor PHP Object Injection in Icegram <= 3.1.31 versions.CVE-2026-97284 · affects up to 3.1.31 · reported by PatchstackHigh 8.8
• Aug 1, 2026Icegram Engage – Popups, Optins, CTAs & Lead Generation: Second-order SQL InjectionCVE-2026-16087 · affects up to 3.1.42 · reported by WordfenceMedium 6.5
• Jan 22, 2026Icegram: Missing AuthorizationCVE-2025-68507 · affects up to 3.1.35 · reported by PatchstackMedium 6.5
• May 15, 2025Icegram Engage: Does not sanitise and escape some of its settingsCVE-2024-13486 · fixed in 3.1.32 · reported by WPScanMedium 4.8
• May 15, 2025Icegram Engage: Does not sanitise and escape some of its settingsCVE-2024-13482 · fixed in 3.1.32 · reported by WPScanMedium 4.8
• Jan 24, 2025Icegram: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24542 · affects up to 3.1.31 · reported by PatchstackMedium 6.5
• Jan 6, 2025Icegram Engage: Does not sanitise and escape some of its Campaign settingsCVE-2024-12302 · fixed in 3.1.32 · reported by WPScanMedium 6.1
• Nov 1, 2024Icegram: Missing AuthorizationCVE-2024-39625 · affects up to 3.1.24 · reported by PatchstackMedium 5.3
• Aug 19, 2024Icegram: Missing Authentication for Critical FunctionCVE-2024-43272 · affects up to 3.1.24 · reported by PatchstackMedium 5.3
• Aug 18, 2024Icegram: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43344 · affects up to 3.1.25 · reported by PatchstackMedium 6.5
• Jun 8, 2024Icegram: Missing AuthorizationCVE-2024-21748 · affects up to 3.1.21 · reported by PatchstackMedium 4.3
• Feb 1, 2024Icegram Engage – WordPress Lead Generation, Popup Builder, CTA, Optins and Email List Building: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51532 · affects up to 3.1.19 · reported by PatchstackMedium 6.5
• Jan 5, 2024Icegram Engage – WordPress Lead Generation, Popup Builder, CTA, Optins and Email List Building: Cross-Site Request Forgery (CSRF)CVE-2023-52119 · affects up to 3.1.18 · reported by PatchstackMedium 4.3
• Jun 12, 2023Icegram Engage: Does not escape a parameter before outputting it back in an attributeCVE-2023-2398 · fixed in 3.1.12 · reported by WPScanMedium 6.1
• Oct 19, 2021WordPress Popups, Welcome Bar, Optins and Lead Generation Plugin – Icegram (versions <= 2.0.2) vulnerable at "Headline" (&message_data[16][headline]) input.CVE-2021-36832 · affects up to 2.0.2 · reported by PatchstackMedium 4.8
• Sep 16, 2019The icegram plugin before 1.9.19 for WordPress has XSS.CVE-2016-10963 · fixed in 1.9.19 · reported by MITREMedium 6.1
• Sep 16, 2019The icegram plugin before 1.9.19 for WordPress has CSRF via the wp-admin/edit.php option_name parameter.CVE-2016-10962 · fixed in 1.9.19 · reported by MITREMedium 6.5
• Aug 30, 2019The icegram plugin before 1.10.29 for WordPress has ig_cat_list XSS.CVE-2019-15830 · fixed in 1.10.29 · reported by MITRE1.0% oddsMedium 5.4

Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.