EUVD-2025-210828
GHSA-r39r-vh49-3w8m
Severity by source
AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
PR:H reflects mandatory WordPress Administrator access to plant the payload; UI:R for victim page load; C:L and I:L consistent with stored XSS scope; no availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The Icegram Express WordPress plugin before 5.8.6 does not properly escape a list description setting before outputting it within an HTML attribute, which could allow users with the Administrator role and above to perform Stored Cross-Site Scripting attacks.
AnalysisAI
Stored Cross-Site Scripting in Icegram Express WordPress plugin versions before 5.8.6 allows administrator-level users to inject malicious scripts into HTML attributes via the list description setting. When another user subsequently loads the affected page, the injected payload executes in their browser, enabling session hijacking, credential capture, or unauthorized actions on their behalf. A publicly available proof-of-concept exploit has been confirmed by WPScan, though real-world impact is substantially constrained by the high-privilege prerequisite required to plant the payload.
Technical ContextAI
Icegram Express is a WordPress email list management and newsletter plugin. The vulnerability arises from insufficient output escaping applied to the list description setting when it is reflected inside an HTML attribute context - a classic stored XSS pattern (CWE-79, though NVD lists CWE as N/A for this entry). Because the payload is persisted to the WordPress database and rendered on subsequent page loads, the attack surface extends to any user who loads the affected admin page after injection, rather than being limited to a single reflected interaction. The affected CPE (cpe:2.3:a:unknown:icegram_express:*:*:*:*:*:*:*:*) carries a placeholder 'unknown' vendor field; the plugin is published by Icegram on WordPress.org.
RemediationAI
Update Icegram Express to version 5.8.6 or later, which introduces proper HTML attribute escaping for the list description field. The patch is available through the standard WordPress plugin update interface or directly from the WordPress.org plugin repository. No official workarounds are documented; in environments where immediate patching is not possible, restricting the Administrator role to the smallest set of trusted users reduces the attack surface, though this is a compensating measure and not a substitute for applying the fix. Full advisory details are available at https://wpscan.com/vulnerability/263e7dc0-61bb-468e-9e15-a6b6789923f4/.
More in Icegram Express
View allThe Icegram Express WordPress plugin before 5.7.50 does not sanitise and escape some of its Template settings, which cou
The Email Subscribers by Icegram Express - Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin f
The Icegram Express plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 5.6.23 v
The Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘options[list_id]’ parameter in all vers
The Icegram Express formerly known as Email Subscribers WordPress plugin before 5.7.52 does not sanitise and escape some
Missing Authorization vulnerability in Icegram.1.21. Rated medium severity (CVSS 5.4), this vulnerability is remotely ex
A vulnerability in Icegram Email Subscribers & Newsletters email-subscribers.5.2. Rated medium severity (CVSS 4.7), this
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today