Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress

82 Quality Score

Active Installs

21/30

With 60,000 active installs it is a mid-tier plugin, well behind category leaders that have crossed 100,000 or even 1,000,000 installs.

Update Freshness

25/25

A perfect maintenance score reflects a recent update in July 2026 and a long compatibility window that traces back to WordPress 3.9, showing the developer keeps the plugin current.

User Rating

14/15

A 92 out of 100 from 1,168 reviewers is a strong signal that everyday users are happy with how the plugin works once installed.

Support Health

8/15

Only 3 of 11 support threads (27.3%) are resolved, which is a meaningful red flag if you expect timely help when something breaks.

WP Compatibility

15/15

It is tested with WordPress 7.0 and requires PHP 7.0+, so it will run cleanly on any reasonably modern WordPress stack.

Scores higher than 88% of indexed plugins

About

Add subscription forms on the website and send newsletters & automatically send post notification about new blog posts once it gets published.

Active Installs 50k+

Rating ★★★★½ 4.6/5

Last Updated 2026-09-23 10:59am GMT

Requires WordPress 3.9+

Tested Up To 7.1.2

Requires PHP 7.0+

Security History

46 known vulnerabilities, all patched

6 Critical 8 High 32 Medium

Most recent: September 7, 2026

View details ▸

Email Subscribers & Newsletters <= 5.9.27 - Unauthenticated Arbitrary Shortcode Execution via Subscriber Name Field Medium

September 7, 2026 Patched in ["5.9.28"] CVE-2026-12757

Icegram Express <= 5.8.5 - Authenticated (Administrator+) Stored Cross-Site Scripting Medium

September 1, 2026 Patched in ["5.8.6"] CVE-2025-15692

Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress <= 5.9.33 - Unauthenticated Stored Cross-Site Scripting High

August 27, 2026 Patched in ["5.9.34"] CVE-2026-81290

Email Subscribers & Newsletters <= 5.9.27 - Missing Authorization to Authenticated (Contributor+) Settings Modification via ig_es_handle_request AJAX Action Medium

July 1, 2026 Patched in ["5.9.28"] CVE-2026-11592

Email Subscribers & Newsletters <= 5.9.16 - Authenticated (Administrator+) SQL Injection via 'workflow_ids' Parameter Medium

March 3, 2026 Patched in ["5.9.17"] CVE-2026-1651

Email Subscribers & Newsletters <= 5.9.10 - Missing Authentication to Unauthenticated Action Scheduler Task Execution Medium

December 11, 2025 Patched in ["5.9.11"] CVE-2025-12348

Email Subscribers & Newsletters <= 5.9.10 - Missing Authentication to Unauthenticated Mailing Queue Trigger Medium

November 18, 2025 Patched in ["5.9.11"] CVE-2025-12349

Email Subscribers & Newsletters <= 5.9.10 - Authenticated (Administrator+) PHP Object Injection Medium

November 8, 2025 Patched in ["5.9.11"] CVE-2025-66055

Email Subscribers & Newsletters <= 5.7.49 - Authenticated (Administrator+) Stored Cross-Site Scripting Medium

April 3, 2025 Patched in ["5.7.50"] CVE-2025-0671

Email Subscribers & Newsletters <= 5.7.51 - Authenticated (Administrator+) Stored Cross-Site Scripting Medium

March 27, 2025 Patched in ["5.7.52"] CVE-2024-11924

Email Subscribers by Icegram Express – Affordable, Powerful Email Marketing for WordPress & WooCommerce <= 5.7.44 - Authenticated (Admin+) Stored Cross-Site Scripting via Form Settings Medium

December 23, 2024 Patched in ["5.7.45"] CVE-2024-12567

Email Subscribers by Icegram Express – Affordable, Powerful Email Marketing for WordPress & WooCommerce <= 5.7.44 - Authenticated (Admin+) Stored Cross-Site Scripting via Workflow Settings Medium

December 23, 2024 Patched in ["5.7.45"] CVE-2024-12568

Email Subscribers by Icegram Express – Affordable, Powerful Email Marketing for WordPress & WooCommerce <= 5.7.44 - Authenticated (Admin+) Stored Cross-Site Scripting Medium

December 23, 2024 Patched in ["5.7.45"] CVE-2024-12566

Email Subscribers by Icegram Express – Affordable, Powerful Email Marketing for WordPress & WooCommerce <= 5.7.44 - Authenticated (Admin+) Stored Cross-Site Scripting via Text Block Medium

December 23, 2024 Patched in ["5.7.45"] CVE-2024-11636

Email Subscribers by Icegram Express – Affordable, Powerful Email Marketing for WordPress & WooCommerce <= 5.7.43 - Authenticated (Admin+) SQL Injection Medium

December 16, 2024 Patched in ["5.7.44"] CVE-2024-12311

Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.34 - Authenticated (Subscriber+) Arbitrary Shortcode Execution Medium

October 1, 2024 Patched in ["5.7.35"] CVE-2024-8254

Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.34 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure Medium

September 25, 2024 Patched in ["5.7.35"] CVE-2024-8771

Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.26 - Missing Authorization Medium

July 16, 2024 Patched in ["5.7.27"] CVE-2024-5703

Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.25 - Unauthenticated SQL Injection via unsubscribe Critical

July 1, 2024 Patched in ["5.7.26"] CVE-2024-6172

Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.23 - Unauthenticated SQL Injection via optin Critical

June 20, 2024 Patched in ["5.7.24"] CVE-2024-5756

Icegram Express <= 5.7.22 - Authenticated (Subscriber+) SQL Injection Vulnerability via options[list_id] High

June 11, 2024 Patched in ["5.7.23"] CVE-2024-4845

Email Subscribers by Icegram Express <= 5.7.20 - Unauthenticated SQL Injection via hash Critical

June 4, 2024 Patched in ["5.7.21"] CVE-2024-4295

Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.17 - Missing Authorization Medium

May 22, 2024 Patched in ["5.7.18"] CVE-2024-3626

Email Subscribers by Icegram Express <= 5.7.19 - Missing Authorization in handle_ajax_request High

May 14, 2024 Patched in ["5.7.20"] CVE-2024-4010

Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.14 - Unauthenticated SQL Injection Critical

April 15, 2024 Patched in ["5.7.15"] CVE-2024-2876

Icegram Express <= 5.7.14 - Authenticated (Administrator+) Cross-Site Scripting via CSV import Medium

April 5, 2024 Patched in ["5.7.16"] CVE-2024-2656

Email Subscribers & Newsletters <= 5.7.13 - Missing Authorization Medium

April 5, 2024 Patched in ["5.7.14"] CVE-2024-31352

Email Subscribers & Newsletters <= 5.7.11 - Reflected Cross-Site Scripting via campaign_id Medium

March 26, 2024 Patched in ["5.7.12"] CVE-2024-22300

Icegram Express <= 5.6.23 - Authenticated (Administrator+) Directory Traversal to Arbitrary File Read Critical

October 11, 2023 Patched in ["5.6.24"] CVE-2023-5414

Icegram Express <= 5.5.2 - Unauthenticated CSV Injection Medium

February 6, 2023 Patched in ["5.5.3"] CVE-2022-45810

Icegram Express <= 5.4.19 - Authenticated (Subscriber+) SQL Injection High

November 21, 2022 Patched in ["5.5.0"] CVE-2022-3981

Email Subscribers & Newsletters <= 5.3.1 - Authenticated (or Cross-Site Request Forgery) Blind SQL Injection High

February 11, 2022 Patched in ["5.3.2"] CVE-2022-0439

Email Subscribers & Newsletters <= 4.5.5 - Unauthenticated Email Forgery Medium

September 9, 2020 Patched in ["4.5.6"] CVE-2020-5780

Icegram Email Subscribers & Newsletters <= 4.5.0 - Authenticated SQL Injection Medium

July 16, 2020 Patched in ["4.5.1"] CVE-2020-5768

Icegram Email Subscribers & Newsletters Plugin for WordPress <= 4.5.0 - Cross-Site Request Forgery High

July 13, 2020 Patched in ["4.5.1"] CVE-2020-5767

Email Subscribers & Newsletters < 4.3.1 - Unauthenticated Blind SQL Injection High

November 13, 2019 Patched in ["4.3.1"] CVE-2019-20361

Email Subscribers & Newsletters <= 4.2.2 - Missing Authorization Medium

November 13, 2019 Patched in ["4.2.3"] CVE-2019-19984

Email Subscribers & Newsletters <= 4.2.2 - Missing Authorization to Test Email Medium

November 13, 2019 Patched in ["4.2.3"] CVE-2019-19980

Email Subscribers & Newsletters <= 4.2.2 - Unauthenticated File Download w/ Information Disclosure Medium

November 13, 2019 Patched in ["4.2.3"] CVE-2019-19985

Email Subscribers & Newsletters <= 4.2.2 - Cross-Site Request Forgery on Settings Medium

November 13, 2019 Patched in ["4.2.3"] CVE-2019-19981

Email Subscribers & Newsletters <= 4.2.2 - Unauthenticated Option Creation Medium

November 13, 2019 Patched in ["4.2.3"] CVE-2019-19982

Email Subscribers & Newsletters <= 4.1.7 - SQL Injection Critical

July 22, 2019 Patched in ["4.1.8"] CVE-2019-13569

Email Subscribers & Newsletters <= 4.1.6 - Cross-Site Scripting Medium

July 12, 2019 Patched in ["4.1.7"] CVE-2019-14364

Email Subscribers & Newsletters <= 3.4.12 - Cross-Site Scripting Medium

May 28, 2018 Patched in ["3.5.0"] CVE-2018-0602

Email Subscribers & Newsletters <= 3.4.7 - Unauthenticated Subscriber Download High

January 24, 2018 Patched in ["3.4.8"] CVE-2018-6015

Email Subscribers & Newsletters < 2.9.1 - Cross-Site Scripting Medium

August 10, 2015 Patched in ["2.9.1"]

What It Does

Email Subscribers lets WordPress site owners capture subscriber emails through opt-in forms and then send manual newsletters or automatic post notifications whenever a new blog post is published. All subscriber data is stored in your own WordPress database, so you are not locked into a third-party email service. It is a self-contained list management and broadcast tool aimed at publishers who want to keep email marketing in-house.

Who It's For

This plugin fits bloggers, niche content sites, and small businesses with lists in the low thousands who want a free, host-it-yourself newsletter tool without paying for Mailchimp, MailPoet, or a dedicated ESP. It is a good fit if your main goal is notifying readers about new posts and sending occasional broadcast emails rather than building complex automation funnels.

Who Should Skip It

If you need advanced automation, segmentation, A/B testing, WooCommerce integration, or delivery infrastructure that handles hundreds of thousands of subscribers, skip this and use a hosted ESP like MailPoet, Mailchimp, or Hostinger Reach. Also avoid it if you rely on fast, responsive developer support, given the low resolution rate on the WordPress.org forum.

The Bottom Line

Email Subscribers delivers exactly what its name promises, and a 92/100 user rating plus an overall 79.29/100 score confirm it does the basics well for small publishers. The weak support thread resolution rate (27.3%) is the main caveat, so you should be comfortable troubleshooting on your own or via documentation. For simple, self-hosted newsletters and post notifications it is a solid free pick, but anyone running a serious email program will outgrow it.

Pick this if you want a hosted, AI-assisted email marketing solution with stronger deliverability and far broader adoption (1,000,000 installs).

MC4WP: Mailchimp for WordPress 89/100

Choose this when you already use Mailchimp or want a dedicated ESP for advanced segmentation, analytics, and automation instead of storing lists in WordPress.

MailPoet – Newsletters, Email Marketing, and Automation 89/100

Go with MailPoet if you want built-in sending infrastructure, WooCommerce workflows, and a more polished newsletter editor than this plugin offers.

Newsletter – Send awesome emails from WordPress 85/100

Pick Newsletter if you need a self-hosted alternative with a stronger template system and more extension options for subscription management.

Newsletters, Email Marketing, SMS and Popups by Omnisend 84/100

Choose Omnisend when you run an ecommerce store and need email plus SMS, popups, and product-driven automations in one integration.