CVE-2026-1255
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
The YS LeadGen plugin for WordPress in all versions up to and including 2.1.4 is vulnerable to Sensitive Information Exposure. The 'ysleadgen_get_captured_data' AJAX action is accessible to unauthenticated users, allowing retrieval of all captured form submission data, including personally identifiable information (names, email addresses, message content).
Risk Assessment
An unauthenticated attacker can mass-retrieve personal data submitted through the forms. This may result in a personal data breach (GDPR), leakage of customer information, and legal and reputational consequences.
Recommendation
Update the YS LeadGen plugin to a version newer than 2.1.4 as soon as it becomes available. Until a fix is released, consider disabling the plugin or restricting access to the 'ysleadgen_get_captured_data' AJAX action, and review logs for unauthorized access.
Other vulnerabilities in YS LeadGen
Original NVD description (English source)
The YS LeadGen plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4 due to the 'ysleadgen_get_captured_data' AJAX action being accessible to unauthenticated users. This makes it possible for unauthenticated attackers to retrieve all captured form submission data, including personally identifiable information (PII) such as names, email addresses, and message content submitted through YS LeadGen forms.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS