Skip to content
PluginCanary

Email Subscribers & Newsletters by

Email Subscribers & Newsletters by Icegram Express - Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress
by Icegram · 50,000+ active installs · Checked 4 Nov 2026
Healthy

Healthy: maintained, last release 23 Oct 2026, 77 releases in 24 months, no unpatched vulnerabilities.

85/ 100 Canary Score
Sub-scores for Email Subscribers & Newsletters by
Ownership100
Maintenance100
Security60
Support80
Reputation85

How the score works

Quick answers

Is Email Subscribers & Newsletters by still maintained?
Yes. Last release 23 Oct 2026, 77 releases in the last 24 months. 23 Oct 2026 · wordpress.org
Who owns Email Subscribers & Newsletters by, and has it changed hands?
No change recorded. Main committer Icegram since May 2018. 4 Nov 2026 · SVN log
Was Email Subscribers & Newsletters by removed from wordpress.org?
No. Listed on wordpress.org as of 4 Nov 2026. 4 Nov 2026 · wordpress.org
Is Email Subscribers & Newsletters by safe?
47 known vulnerabilities, all fixed (latest in 5.9.35). Not on the exploited list. 21 Sep 2026 · Wordfence Intelligence
Is the latest Email Subscribers & Newsletters by update safe to install?
No ownership change before 5.9.40. No one-star spike after it. 22 Oct 2026 · Release history

Active signals

Facts we detected, with links to the source.

No open risk signals. Signals appear here when we detect an ownership change, closure, vulnerability or decline.

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
Icegram17 May 2018 to 23 Oct 2026, 723 commits

1 committer recorded. No ownership change since 2014.

Maintenance

Last release
12 days ago
Releases, 24 months
77
Tested up to
7.1 current
Requires PHP
7.0 supported 8.2+
Releases per quarter
Releases per quarter for Email Subscribers & Newsletters by
Q1 202410
Q2 202412
Q3 20249
Q4 202411
Q1 202513
Q2 202511
Q3 20259
Q4 20258
Q1 20269
Q2 20267
Q3 202610
Q4 20263

Last release 23 Oct 2026. Tested with WordPress 7.1 (current).

Reputation

Last 90 days: 5.0 (2 reviews). Lifetime: 4.6.

Average rating per quarter for Email Subscribers & Newsletters by
Q2 20254.9
Q3 20255.0
Q4 20254.7
Q1 20265.0
Q2 20265.0
Q3 20265.0

Average rating rose from 4.9 to 5.0 between Q2 2025 and Q3 2026.

Rating distribution
5 star1028
4 star37
3 star16
2 star13
1 star76
Latest low reviews

Security record

16 vulnerabilities in 24 months (47 on record), all patched (latest fixed in 5.9.35).

Show 47 patched vulnerabilities
PublishedIssueCVSSAffectedFixed inDays to patch
21 Sep 2026Email Subscribers by Icegram Express <= 5.9.34 - Missing Authorization5.3<= 5.9.345.9.35Patched before disclosure
7 Sep 2026Email Subscribers & Newsletters <= 5.9.27 - Unauthenticated Arbitrary Shortcode Execution via Subscriber Name Field6.5<= 5.9.275.9.28Patched before disclosure
1 Sep 2026Icegram Express <= 5.8.5 - Authenticated (Administrator+) Stored Cross-Site Scripting4.4<= 5.8.55.8.6Patched before disclosure
27 Aug 2026Email Subscribers & Newsletters - Email Marketing, Post Notifications & Newsletter Plugin for WordPress <= 5.9.33 - Unauthenticated Stored Cross-Site Scripting7.2<= 5.9.335.9.34Patched before disclosure
1 Jul 2026Email Subscribers & Newsletters <= 5.9.27 - Missing Authorization to Authenticated (Contributor+) Settings Modification via ig_es_handle_request AJAX Action4.3<= 5.9.275.9.28Patched before disclosure
3 Mar 2026Email Subscribers & Newsletters <= 5.9.16 - Authenticated (Administrator+) SQL Injection via 'workflow_ids' Parameter6.5<= 5.9.165.9.17Patched before disclosure
11 Dec 2025Email Subscribers & Newsletters <= 5.9.10 - Missing Authentication to Unauthenticated Action Scheduler Task Execution5.3<= 5.9.105.9.11Patched before disclosure
18 Nov 2025Email Subscribers & Newsletters <= 5.9.10 - Missing Authentication to Unauthenticated Mailing Queue Trigger5.3<= 5.9.105.9.11Patched before disclosure
8 Nov 2025Email Subscribers & Newsletters <= 5.9.10 - Authenticated (Administrator+) PHP Object Injection6.6<= 5.9.105.9.115
3 Apr 2025Email Subscribers & Newsletters <= 5.7.49 - Authenticated (Administrator+) Stored Cross-Site Scripting4.4<= 5.7.495.7.50Patched before disclosure
27 Mar 2025Email Subscribers & Newsletters <= 5.7.51 - Authenticated (Administrator+) Stored Cross-Site Scripting4.4<= 5.7.515.7.52Patched before disclosure
23 Dec 2024Email Subscribers by Icegram Express - Affordable, Powerful Email Marketing for WordPress & WooCommerce <= 5.7.44 - Authenticated (Admin+) Stored Cross-Site Scripting via Form Settings4.4<= 5.7.445.7.45Patched before disclosure
23 Dec 2024Email Subscribers by Icegram Express - Affordable, Powerful Email Marketing for WordPress & WooCommerce <= 5.7.44 - Authenticated (Admin+) Stored Cross-Site Scripting via Workflow Settings4.4<= 5.7.445.7.45Patched before disclosure
23 Dec 2024Email Subscribers by Icegram Express - Affordable, Powerful Email Marketing for WordPress & WooCommerce <= 5.7.44 - Authenticated (Admin+) Stored Cross-Site Scripting4.4<= 5.7.445.7.45Patched before disclosure
23 Dec 2024Email Subscribers by Icegram Express - Affordable, Powerful Email Marketing for WordPress & WooCommerce <= 5.7.44 - Authenticated (Admin+) Stored Cross-Site Scripting via Text Block4.4<= 5.7.445.7.45Patched before disclosure
16 Dec 2024Email Subscribers by Icegram Express - Affordable, Powerful Email Marketing for WordPress & WooCommerce <= 5.7.43 - Authenticated (Admin+) SQL Injection4.9<= 5.7.435.7.44Patched before disclosure
1 Oct 2024Email Subscribers by Icegram Express - Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.34 - Authenticated (Subscriber+) Arbitrary Shortcode Execution5.4<= 5.7.345.7.35Patched before disclosure
25 Sep 2024Email Subscribers by Icegram Express - Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.34 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure4.3<= 5.7.345.7.35Patched before disclosure
16 Jul 2024Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.26 - Missing Authorization4.3<= 5.7.265.7.27Patched before disclosure
1 Jul 2024Email Subscribers by Icegram Express - Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.25 - Unauthenticated SQL Injection via unsubscribe9.8<= 5.7.255.7.26Patched before disclosure
20 Jun 2024Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.23 - Unauthenticated SQL Injection via optin9.8<= 5.7.235.7.24Patched before disclosure
11 Jun 2024Icegram Express <= 5.7.22 - Authenticated (Subscriber+) SQL Injection Vulnerability via options[list_id]8.8<= 5.7.225.7.23Patched before disclosure
4 Jun 2024Email Subscribers by Icegram Express <= 5.7.20 - Unauthenticated SQL Injection via hash9.8<= 5.7.205.7.21Patched before disclosure
22 May 2024Email Subscribers by Icegram Express - Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.17 - Missing Authorization4.3<= 5.7.175.7.18Patched before disclosure
14 May 2024Email Subscribers by Icegram Express <= 5.7.19 - Missing Authorization in handle_ajax_request8.8<= 5.7.195.7.20Patched before disclosure

Changelog mentions of security fixes: 5.9.34 (security).

Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.

Support

80% of 5 support threads resolved in the last 2 months.

Momentum

50,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for Email Subscribers & Newsletters by
4 May 20261,340
11 May 202622,505
18 May 20265,460
25 May 20263,440
1 Jun 202622,067
8 Jun 202622,496
15 Jun 202621,921
22 Jun 202622,619
29 Jun 202622,971
6 Jul 20266,219
13 Jul 202623,060
20 Jul 202622,035
27 Jul 202623,074
3 Aug 202624,296
10 Aug 20264,247
17 Aug 20262,958
24 Aug 202623,032
31 Aug 20264,985
7 Sep 20263,642
14 Sep 202641,554
21 Sep 202625,114
28 Sep 202622,685
5 Oct 20266,707
12 Oct 202621,381
19 Oct 202623,743
26 Oct 20267,241
2 Nov 2026655

Weekly downloads over the last 4 weeks are 17% below the 27-week average.

Healthier alternatives

Same job, rated Healthy, higher Canary Score and at least 10,000 installs. Never sponsored.

KlaviyoScore 100 · 100,000+Mailjet Email MarketingScore 98 · 10,000+SureContactScore 97 · 10,000+Mailchimp List Subscribe FormScore 95 · 60,000+Kit (formerly ConvertKit)Score 95 · 40,000+

Facts

Version5.9.40
AuthorIcegram
Added9 May 2014
Last updated23 Oct 2026
Active installs50,000+
Requires WordPress3.9
Tested up to7.1.4
Requires PHP7.0
CategoryMarketing & Advertising > Email Marketing & Campaigns
Tagsnewsletter, Email Marketing, email automation, post notification, woocommerce emails

Other plugins by this author: Icegram Engage - Popups, Welcome Bars, Optins, Slide-Ins & Lead Generation for WordPress, Icegram Mailer - Reliable Email Deliverability, No-Code SMTP Replacement & Email Logs for WordPress, Icegram Collect - Easy Contact Form, Subscription Form & Lead Collection Plugin for WordPress, Email Subscribers - Group Selector, Duplicate Pages and Posts - One-Click Clone WordPress Posts & Pages to Draft, Icegram Cookie Manager - GDPR, CCPA & Google Consent Mode v2 Cookie Banner (Fast & Free), Icegram User Switching - Switch User Accounts Instantly, Login as User & Test Roles for WordPress & WooCommerce, Icegram AI Content Engine - AI Blog Writer, SEO Content Generator & AEO Article Builder for WordPress

Questions

Is Email Subscribers & Newsletters by still maintained?

Yes. Last release 23 Oct 2026, 77 releases in the last 24 months.

Who owns Email Subscribers & Newsletters by, and has it changed hands?

No change recorded. Main committer Icegram since May 2018.

Was Email Subscribers & Newsletters by removed from wordpress.org?

No. Listed on wordpress.org as of 4 Nov 2026.

Is Email Subscribers & Newsletters by safe?

47 known vulnerabilities, all fixed (latest in 5.9.35). Not on the exploited list.

Is the latest Email Subscribers & Newsletters by update safe to install?

No ownership change before 5.9.40. No one-star spike after it.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews and support forum, Wordfence Intelligence, CISA KEV, NVD.Plugin data refreshed 4 Nov 2026.Report a data issue