Posted on

XSS Security fix to Icegram WordPress plugin is coming soon!

Did not find Icegram on WordPress?

If you try to download / search for Icegram on WordPress plugins repository, you get an error saying:

“We couldn’t find that plugin. Maybe you were looking for one of these?”

Why is Icegram not showing on WordPress?

Yorick Koster from Securify reported an XSS vulnerability in Icegram 11th July. This Cross-Site Request Forgery allows an attacker to overwrite any WordPress option with the value true.

It’s a rare case situation, but since this is about security, we don’t take it lightly.

The plugin was deactivated from the WordPress plugins repository – so people do not get the problematic version.

This is the reason why you can’t download Icegram from WordPress currently.

Is it fixed?

Yes. We submitted a fix for this particular issue on same day. Based on Ipstenu’s feedback, we also submitted additional changes to increase security in other areas too.

6 thoughts on “XSS Security fix to Icegram WordPress plugin is coming soon!

  1. I have a client that uses Icegram for pop-ups, and it’s no longer working, v1.9.18, and it’s been removed, ok, but now your download link isn’t working either. Please let me know where I can get a patched version? Or we’ll switch the client over to another plugin soon I guess.

    1. Hi Rob,

      We’ve fixed the issue and the download link is now working.
      Kindly download the latest version of Icegram here.
      Sorry for the inconvenience. Let me know if you need any help.

      Regards,
      Andrea

  2. Hi guys,

    I just updated a site with the new version and it crashed the site. (or something did).

    If I remove the plugin all is ok. Any known conflicts with the new version?

    Cheers,
    Dave

    1. Hi David,

      Thanks for the headsup! We have looked into the issue and fixed it as well. I request you to kindly update to the latest version fo Icegram. It should work fine. Do let me know, i fyou face any difficulties.

      Regards,
      Andrea.

      1. Hi Andrea,

        Thanks for the prompt action – all is working perfectly! Much appreciated.

        Dave

        1. Glad to hear that Dave. Feel free to contact whenever you need any help. Have an awesome day! – Andrea

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.