CVE-2026-1256

MediumCVSS 6.4

Published: 19/09/2026(UTC)Updated: 21/09/2026(UTC)Translated: 19/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

11th percentile - higher than 11% of all known CVEs

Summary

The YS LeadGen plugin for WordPress is vulnerable to authorization bypass and Stored Cross-Site Scripting via multiple AJAX endpoints in all versions up to and including 2.1.4 due to missing capability checks on popup management actions. This allows authenticated attackers with Subscriber-level access and above to create arbitrary popups and inject malicious JavaScript that executes when the popup is displayed, leading to Stored XSS.

Risk Assessment

The risk includes user session hijacking, data theft, and malware propagation on the site.

Recommendation

It is recommended to update the plugin to the latest version and enforce the principle of least privilege.

Other vulnerabilities in YS LeadGen

CVE-2026-1255High
The YS LeadGen plugin for WordPress in all versions up to and including 2.1.4 is vulnerable to Sensitive Information Exposure. The 'ysleadgen_get_captured_data' AJAX action is accessible to unauthenticated users, allowing retrieval of all captured form submission data, including personally identifiable information (names, email addresses, message content).

Original NVD description (English source)

The YS LeadGen plugin for WordPress is vulnerable to authorization bypass and Stored Cross-Site Scripting via multiple AJAX endpoints in all versions up to, and including, 2.1.4 due to missing capability checks on popup management actions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary popups and inject malicious JavaScript that executes when the popup is displayed, leading to Stored XSS.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS