Icegram Engage – Popups, Welcome Bars, Optins, Slide-Ins & Lead Generation for WordPress

Icegram Engage – Popups, Welcome Bars, Optins, Slide-Ins & Lead Generation for WordPress has 20 disclosed vulnerabilities in the WordSec catalog, reported between 2016 and 2026; all 20 are fixed as of October 2026. Their average CVSS score is 5.9, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 2 high. 2024 was the busiest year with 5 disclosures.

The most common weakness is Cross-Site Scripting, behind 12 of the records (60%). Other recurring categories include Missing Authorization, Cross-Site Request Forgery (CSRF).

Every one of the 20 issues recorded for Icegram Engage – Popups, Welcome Bars, Optins, Slide-Ins & Lead Generation for WordPress has a vendor fix available, so running the current release closes all known holes.

14 independent researchers contributed these findings, most of them (3) reported by Dmitrii Ignatyev. Icegram Engage – Popups, Welcome Bars, Optins, Slide-Ins & Lead Generation for WordPress is installed on roughly 10,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

01234567891009.06.2014Today19.07.20168.8Icegram <= 1.9.18 - Cross-Site Request Forgery CVSS 8.8 · 19.07.20166.1Icegram <= 1.9.18 - Cross-Site Scripting CVSS 6.1 · 19.07.201609.07.20196.4Icegram <= 1.10.28.2 - Cross-Site Scripting CVSS 6.4 · 09.07.201917.08.20214.8Icegram <= 2.0.2 - Authenticated Stored Cross-Site Scripting CVSS 4.8 · 17.08.202122.11.20216.1Icegram <= 2.0.4 - Reflected Cross-Site Scripting via message_id CVSS 6.1 · 22.11.202130.05.20226.1Icegram Engage <= 2.1.7 - Cross-Site Scripting CVSS 6.1 · 30.05.202222.05.20236.1Icegram Engage <= 3.1.11 - Reflected Cross-Site Scripting CVSS 6.1 · 22.05.202327.12.20236.4Icegram <= 3.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via Campaign Message CVSS 6.4 · 27.12.202328.12.20234.3Icegram <= 3.1.18 - Cross-Site Request Forgery via save_campaign_preview CVSS 4.3 · 28.12.202305.01.20244.3Icegram <= 3.1.21 - Missing Authorization CVSS 4.3 · 05.01.202422.07.20245.3Icegram <= 3.1.24 - Missing Authorization to Unauthenticated Message Duplication CVSS 5.3 · 22.07.202412.08.20245.3Icegram <= 3.1.24 - Missing Authorization CVSS 5.3 · 12.08.202416.08.20246.4Icegram <= 3.1.25 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 16.08.202416.12.20246.4Icegram Engage <= 3.1.31 - Authenticated (Author+) Stored Cross-Site Scripting CVSS 6.4 · 16.12.202424.01.20256.4Icegram <= 3.1.31 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 24.01.202503.03.20254.4Icegram Engage <= 3.1.31 - Authenticated (Administrator+) Stored Cross-Site Scripting CVSS 4.4 · 03.03.20254.4Icegram Engage <= 3.1.31 - Authenticated (Administrator+) Stored Cross-Site Scripting CVSS 4.4 · 03.03.202505.01.20265.3Icegram <= 3.1.35 - Missing Authorization CVSS 5.3 · 05.01.202631.07.20266.5Icegram Engage <= 3.1.42 - Authenticated (Contributor+) Second-Order SQL Injection via 'messages[][id]' Parameter CVSS 6.5 · 31.07.202601.10.20267.5Icegram Engage – Popups, Optins, CTAs & Lead Generation <= 3.1.31 - Authenticated (Contributor+) PHP Object Injection CVSS 7.5 · 01.10.2026

Strategic Overview

Avg CVSSMedium
5.9/ 10
Patch Coverage100%
Open

0

Fixed

20

Get automatic notifications for all Icegram Engage – Popups, Welcome Bars, Optins, Slide-Ins & Lead Generation for WordPress vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.8CVE-2016-10962

Icegram <= 1.9.18 - Cross-Site Request Forgery

Read the full analysis

Vulnerability Records

20 records
2026-10-01 11:47CVE-2026-97284
7.5
High
Ananda DhakalYes
2026-07-31 19:32CVE-2026-16087
6.5
Medium
Wordfence PRISMYes
2026-01-05 00:00CVE-2025-68507
5.3
Medium
Legion HunterYes
2025-03-03 00:00CVE-2024-13482
4.4
Medium
Dmitrii IgnatyevYes
2025-03-03 00:00CVE-2024-13486
4.4
Medium
Dmitrii IgnatyevYes
2025-01-24 00:00CVE-2025-24542
6.4
Medium
SavPhill (Savphill)Yes
2024-12-16 00:00CVE-2024-12302
6.4
Medium
Dmitrii IgnatyevYes
2024-08-16 00:00CVE-2024-43344
6.4
Medium
SavPhill (Savphill)Yes
2024-08-12 00:00CVE-2024-43272
5.3
Medium
Dhabaleshwar DasYes
2024-07-22 00:00CVE-2024-39625
5.3
Medium
AnonymousYes
Showing 1–10 of 20 reports
Icegram Engage – Popups, Welcome Bars, Optins, Slide-Ins & Lead Generation for WordPress banner
Latestv3.1.46

Icegram Engage – Popups, Welcome Bars, Optins, Slide-Ins & Lead Generation for WordPress

Icegram

Author

Icegram

4.7(370)
94/100
Last Updated
2026-10-26 (2d ago)
Active Installs
10,000+
Downloads
2,576,152
Requires WP
3.9+
Requires PHP
7.1+
Tested up to
WP 7.1.3
Created
2014-06-09 (13y ago)

Turn abandoning visitors into email subscribers, leads, and paying customers — with 12+ on-site message styles, unlimited campaigns, and zero SaaS impression caps. Icegram Engage is the all-in-one WordPress popup builder, welcome bar, slide-in, and lead generation toolkit built for bloggers, agencies, and WooCommerce stores. Unlike popup-only plugins or expensive SaaS tools that throttle your monthly pageviews, Icegram Engage lets you combine multiple message formats inside a single targeted campaign — completely inside WordPress and without writing a single line of code. Explore Features: Icegram Engage Official Page Compare Plans: Icegram Engage Pricing (Free & Max) Browse Templates: Icegram Engage Template Gallery Read the Guides: Icegram Engage Documentation & Knowledge Base Why Choose Icegram Engage Over Typical Popup Plugins? Most WordPress popup plugins either restrict your free account to 500–1,000 monthly impressions, cap you at 3 free popups, or force “Powered by” branding onto your site. Icegram Engage gives you an unthrottled conversion engine free forever: Unlimited Campaigns & Unlimited Impressions: Create as many popups, action bars, and opt-ins as you want with zero monthly visitor or pageview limits. More Than Just Popups (4 Free + 8 Max Message Styles): Combine lightbox popups, floating header/footer bars (Hello Bars), slide-in messengers, and toast notifications in one multi-step campaign. No Forced Branding: Put your brand first — zero mandatory “Powered by” credit links on your frontend campaigns. 100% WordPress-Native & Cache-Friendly: Built-in Lazy Loading loads campaigns asynchronously after page render so your Core Web Vitals and caching plugins stay fast. Works With Any Form or Email Service: Embed forms from Icegram Express, Icegram Collect, Contact Form 7, WPForms, Gravity Forms, or any external ESP HTML form in one click. Curious how Icegram Engage compares to other tools? Check out our detailed comparisons on Icegram Alternatives & Reviews, including Ninja Popups vs. Icegram Engage. Every High-Converting Message Type at Your Fingertips Don’t rely on intrusive popups alone. Icegram Engage lets you match the right message format to every stage of the visitor journey: Included Free Forever: * Lightbox & Opt-In Popups: Classic centered modals for newsletter signups, lead magnets, content upgrades, and discount offers. * Action Bars (Header & Footer Hello Bars): Sticky or floating top and bottom notification bars for sitewide announcements, free shipping bars, and flash sales. * Slide-In Messengers: Polite corner slide-in boxes that capture attention on scroll without blocking page content. * Toast Notifications: Compact, OS-style alert notifications for social proof, urgent updates, and quick CTAs. Unlocked in Icegram Engage Max: * Full-Screen Overlays & Welcome Mats: Distraction-free, full-window takeovers that maximize email opt-in conversions. * Inline Content Blocks & Opt-In Boxes: Embed conversion blocks seamlessly inside blog posts, landing pages, or sidebars. * Sticky Notes, Ribbons & Corner Badges: Eye-catching visual callouts for seasonal promotions and coupon codes. * Sidebars, Interstitials & Tab Triggers: Persistent two-step tab triggers and timed interstitial screens. Everything You Get 100% Free — Forever Unlimited Popups, Action Bars, Slide-Ins & Toasts: Run unlimited simultaneous campaigns across your site. 50+ Mobile-Responsive Templates: Launch in seconds with conversion-tested designs from the Icegram Engage Gallery — including seasonal templates for Black Friday, Cyber Monday, Halloween, and Christmas. Multi-Message Campaign Sequencing: Group multiple message types inside a single campaign (for example, display an Action Bar at 0 seconds, a Slide-In Messenger at 5 seconds, and a Popup at 15 seconds). Smart Page, User & Device Targeting: Show or hide campaigns on specific pages, posts, custom post types, homepage, or wildcard URLs, and filter by logged-in/logged-out status, user roles, or device type (Desktop, Tablet, Mobile). Time Delay & On-Click Triggers: Trigger messages automatically after X seconds on page or when a visitor clicks a specific link or button. Session & Cookie Retargeting: Prevent popup fatigue by hiding messages for X days or for the rest of the session once shown or converted. One-Click Form Embed & Clean-Up: Paste raw HTML form code from any newsletter service using the Embed Form button (which automatically strips conflicting styles) or insert any WordPress form shortcode. Custom CSS, JS & Shortcode Support: Customize colors, fonts, and animations visually, or add custom CSS, JavaScript, and shortcodes directly inside any message. One-Click Campaign Duplication & Lazy Load: Clone winning campaigns in a click and enable asynchronous Lazy Loading for full page-caching compatibility. Icegram Engage Max — Advanced Triggers, Split Testing & Revenue Optimization When you are ready to recover abandoning visitors and optimize conversion rates scientifically, Icegram Engage Max unlocks: Exit-Intent Technology: Detect the exact millisecond a visitor is about to leave your site and trigger a targeted exit popup or discount offer. Advanced Behavioral Triggers: Trigger messages by scroll depth (middle or bottom of page), user inactivity, JavaScript events, two-step click opt-ins, or when a visitor arrives from a specific referring URL. A/B Split Testing: Test headlines, designs, CTA buttons, and message types head-to-head to see which variation wins. Conversion & Impression Analytics: Track views, conversions, and conversion rates per campaign and message directly inside WordPress. Countdown Timers (Static & Evergreen): Create urgency and FOMO for product launches, webinars, and seasonal sales. 100+ Max Templates & 10+ Entrance/Exit Animations: Access the complete template library and attention-grabbing transitions. Geo-Location Targeting & Content Locking: Personalize offers by visitor country/location and gate premium content behind an opt-in form. CTA Click Actions: Open another message, submit a form, or trigger AJAX actions when a visitor clicks your CTA button. Remote Campaigns on Non-WordPress Sites: Deploy your Icegram Engage campaigns on external HTML, Shopify, or non-WordPress landing pages via Icegram Engage Remote. Built for WooCommerce & eCommerce Stores Reduce Cart & Checkout Abandonment (Max): Trigger exit-intent coupon popups when shoppers attempt to leave the cart or checkout page. Free Shipping & Promo Bars (Free & Max): Pin a sticky header Action Bar announcing free shipping thresholds or storewide coupon codes. Cross-Sell & Product Launch Callouts: Highlight featured products, seasonal bundles, and flash sales on specific WooCommerce product categories. Seamless WordPress Ecosystem Integrations Icegram Engage works out of the box with your favorite email marketing platforms, form builders, and page builders: Email Marketing & CRM Platforms: Icegram Express (Email Subscribers), Mailchimp, MailPoet, FluentCRM, ActiveCampaign, AWeber, ConvertKit (Kit), Constant Contact, GetResponse, Campaign Monitor, Brevo (Sendinblue), HubSpot, Drip, Infusionsoft (Keap), Emma, Amazon SES, SendGrid, and SparkPost. WordPress Form Plugins: Icegram Collect, Contact Form 7 (CF7), WPForms, Gravity Forms, Ninja Forms, Forminator, Elementor Pro Forms, Formidable Forms, Fluent Forms, and Mailchimp for WordPress (MC4WP). eCommerce, Page Builders & Multilingual: WooCommerce, Easy Digital Downloads (EDD), Gutenberg Block Editor, Classic Editor, Elementor, Divi, Beaver Builder, WPBakery / Visual Composer, Avada, Wishlist Member, and WPML. Why Site Owners Switch to Icegram Engage “5X More Engagement than OptinMonster! Explored all the popup plugins out there & this is the best WordPress popup plugin I have ever used. Plus it is easy to use and the free themes are fun to help fit our messages as we need them.” – mimdoc “I really love this plugin. It’s one of the best popup plugins I have ever used. I have tried other prominent plugins, but none has provided such top-notch performance. It’s definitely worth buying compared to other high-priced plugins with fewer functionalities.” – liltrucks “Five years of phenomenal results, satisfaction and counting! Icegram Engage has never let me down. It’s an incredible popup plugin & still the best!” – Markarayner “We’ve been using Icegram Engage as well as the compatible Email and Newsletter plugin from Icegram for blog subscription and lead generation forms. It’s easy to set up and it does what it’s supposed to do.” – IrinaT “We needed a simple to use plugin that would allow us to publish a news bulletin popup, and Icegram exceeded expectations. Plus, it’s versatile for campaigns and scheduled notices. Impressive!” – malcstewart Other Popular Plugins from the Icegram Team Icegram Express – Complete self-hosted email marketing, newsletters, post notifications, and WooCommerce automation. Icegram Mailer – Reliable email deliverability, no-code SMTP replacement, and email logs for WordPress. Icegram Collect – Simple lead capture, contact forms, and subscription forms with built-in CRM/webhook sync. Temporary Login Without Password – Create self-expiring admin login links for developers and support teams. Smart Manager – Bulk edit and manage WooCommerce products, orders, coupons, and WordPress posts in an Excel-like spreadsheet. External Services Icegram Engage connects to Icegram services for gallery items and optional user feedback: Template Gallery (icegram.com/gallery): Fetches ready-made campaign templates when browsing or importing designs in the admin dashboard. Feedback API (api.icegram.com): Sends user-submitted feedback and optional diagnostic details only when explicitly submitted by the site administrator. Data is transmitted only when these admin features are used and is handled in accordance with the Icegram Privacy Policy.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C