Skip to content
Sign in
3.5 Low

CVE-2025-15692 The Icegram Express WordPress plugin before 5.8.6 does not properly escape a list description setting before…

Description

The Icegram Express WordPress plugin before 5.8.6 does not properly escape a list description setting before outputting it within an HTML attribute, which could allow users with the Administrator role and above to perform Stored Cross-Site Scripting attacks.

Affected products and versions

Product Affected versions Fixed in
Icegram Express 5.8 earliest → < 5.8.6 5.8.6

Other CVEs of Icegram Express

The 3 CVEs of Icegram Express →
CVE-2025-0671 The Icegram Express WordPress plugin before 5.7.50 does not sanitise and escape some of its Template settings, which… 6.1 Medium CVE-2022-3981 The Icegram Express WordPress plugin before 5.5.1 does not properly sanitise and escape a parameter before using it in a… 8.8 High
Track this CVE