Icegram Engage – Popups, Optins, CTAs & Lead Generation

80 Quality Score

Active Installs

18/30

With 10,000 active installs and a Quality Score popularity component of 60/30, it sits in the mid-range, well behind mainstream competitors like Hostinger Reach at 1,000,000 installs.

Update Freshness

25/25

A perfect 25/25 maintenance score, last updated 2026-04-14, signals the developer is actively shipping patches and keeping pace with WordPress 6.9.4.

User Rating

14/15

A 94/100 rating from 368 reviews is excellent and suggests most users are satisfied with feature set and reliability.

Support Health

8/15

A 50/15 support score is dragged down by a single tracked support thread with a 0.0% resolution rate, which is a yellow flag worth noting.

WP Compatibility

15/15

A full 15/15 compatibility score confirms it works with the current WordPress core and requires only WordPress 3.9, giving it very broad backwards compatibility.

Scores higher than 75% of indexed plugins

About

Create high-converting popups, email optins, and CTAs in minutes. Capture leads, grow your email list, and convert visitors into customers—without cod …

Active Installs 10k+

Rating ★★★★½ 4.7/5

Last Updated 2026-09-24 9:39am GMT

Requires WordPress 3.9+

Tested Up To 7.1.2

Requires PHP 7.0+

Security History

19 known vulnerabilities, all patched

1 High 18 Medium

Most recent: July 31, 2026

View details ▸

Icegram Engage <= 3.1.42 - Authenticated (Contributor+) Second-Order SQL Injection via 'messages[][id]' Parameter Medium

July 31, 2026 Patched in ["3.1.43"] CVE-2026-16087

Icegram <= 3.1.35 - Missing Authorization Medium

January 5, 2026 Patched in ["3.1.36"] CVE-2025-68507

Icegram Engage <= 3.1.31 - Authenticated (Administrator+) Stored Cross-Site Scripting Medium

March 3, 2025 Patched in ["3.1.32"] CVE-2024-13482

Icegram Engage <= 3.1.31 - Authenticated (Administrator+) Stored Cross-Site Scripting Medium

March 3, 2025 Patched in ["3.1.32"] CVE-2024-13486

Icegram <= 3.1.31 - Authenticated (Contributor+) Stored Cross-Site Scripting Medium

January 24, 2025 Patched in ["3.1.32"] CVE-2025-24542

Icegram Engage <= 3.1.31 - Authenticated (Author+) Stored Cross-Site Scripting Medium

December 16, 2024 Patched in ["3.1.32"] CVE-2024-12302

Icegram <= 3.1.25 - Authenticated (Contributor+) Stored Cross-Site Scripting Medium

August 16, 2024 Patched in ["3.1.26"] CVE-2024-43344

Icegram <= 3.1.24 - Missing Authorization Medium

August 12, 2024 Patched in ["3.1.25"] CVE-2024-43272

Icegram <= 3.1.24 - Missing Authorization to Unauthenticated Message Duplication Medium

July 22, 2024 Patched in ["3.1.25"] CVE-2024-39625

Icegram <= 3.1.21 - Missing Authorization Medium

January 5, 2024 Patched in ["3.1.22"] CVE-2024-21748

Icegram <= 3.1.18 - Cross-Site Request Forgery via save_campaign_preview Medium

December 28, 2023 Patched in ["3.1.19"] CVE-2023-52119

Icegram <= 3.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via Campaign Message Medium

December 27, 2023 Patched in ["3.1.20"] CVE-2023-51532

Icegram Engage <= 3.1.11 - Reflected Cross-Site Scripting Medium

May 22, 2023 Patched in ["3.1.12"] CVE-2023-2398

Icegram Engage <= 2.1.7 - Cross-Site Scripting Medium

May 30, 2022 Patched in ["2.1.8"] CVE-2022-1776

Icegram <= 2.0.4 - Reflected Cross-Site Scripting via message_id Medium

November 22, 2021 Patched in ["2.0.5"] CVE-2021-24941

Icegram <= 2.0.2 - Authenticated Stored Cross-Site Scripting Medium

August 17, 2021 Patched in ["2.0.3"] CVE-2021-36832

Icegram <= 1.10.28.2 - Cross-Site Scripting Medium

July 9, 2019 Patched in ["1.10.29"] CVE-2019-15830

Icegram <= 1.9.18 - Cross-Site Request Forgery High

July 19, 2016 Patched in ["1.9.19"] CVE-2016-10962

Icegram <= 1.9.18 - Cross-Site Scripting Medium

July 19, 2016 Patched in ["1.9.19"] CVE-2016-10963

What It Does

Icegram Engage lets WordPress site owners build popups, opt-in forms, call-to-action bars, and lead capture campaigns directly from the dashboard, then target them using on-site triggers and behavioural rules. It connects to common email marketing services so captured contacts flow into mailing lists without a separate landing page tool. The core workflow is design a message, set display rules, and watch subscribers arrive.

Who It's For

Small business owners, bloggers, course creators, and e-commerce operators who want a budget-friendly, code-free way to grow an email list and run on-site conversion campaigns. It fits sites that need a handful of well-targeted popups or opt-ins rather than a full marketing automation suite. Agencies serving multiple clients will also find the campaign management useful.

Who Should Skip It

Sites that already use a dedicated CRO or email automation platform (such as HubSpot, OptinMonster, or a full Klaviyo integration) will see little reason to add a second pop-up layer. Very high-traffic publishers who need enterprise-grade A/B testing and analytics will likely outgrow it.

The Bottom Line

Icegram Engage is a well-maintained, highly rated popup and lead generation plugin that delivers solid value for small to mid-sized sites that want to grow a list without paying for a premium tool. The weak support response rate on the one tracked thread and modest install count are the main reasons it does not score higher overall. If you can tolerate slower support and want a free, actively updated popup suite, it is a sensible choice.

Pick this instead if you are already on Hostinger and want a tightly integrated, AI-assisted email marketing tool backed by a much larger install base.

CartFlows – Funnel Builder & Checkout Plugin for WooCommerce 86/100

Pick this instead if your priority is WooCommerce checkout optimization and sales funnels rather than general pop-ups and lead capture.

Popup Builder – Create highly converting, mobile friendly marketing popups. 85/100

Pick this instead if you want a mature popup-only plugin with 200,000 installs and a larger library of pre-built templates.

Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers 84/100

Pick this instead if you need advanced features such as gamified opt-ins, multi-step flows, or deep WooCommerce cart triggers.

WP Popups – WordPress Popup builder 82/100

Pick this instead if you want a lighter, block-editor-native popup builder and do not need Icegram's broader CTA and messenger formats.