Executive brief
Icegram Express is a WordPress plugin that manages email subscription lists. The plugin fails to properly escape user input in the list description field before displaying it in HTML, allowing administrators to inject malicious JavaScript code that executes when other users interact with the list in the admin dashboard. This is a stored vulnerability, meaning the injected code persists and affects all subsequent visits.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the list description setting of the Icegram Express plugin versions prior to 5.8.6. The vulnerable component fails to escape the description field before outputting it into an HTML title attribute in the admin lists table. An authenticated user with Administrator role can inject JavaScript payload (e.g., 123"onmouseover=alert(document.domain)//) into the description field; the payload executes in the browser when any user hovers over the affected list in the admin panel. The attack requires email-subscribers to be active and an Administrator account. The vulnerability is fixed in version 5.8.6 and later.
Affected products
- Icegram Express before 5.8.6
Timeline
- 2026-09-01: disclosed
- 2025-08-06: patched: version 5.8.6 released