CVE-2026-1256

The YS LeadGen plugin for WordPress is vulnerable to authorization bypass and Stored Cross-Site Scripting via multiple AJAX endpoints in all versions up to, and including, 2.1.4 due to missing capability checks on popup management actions. This makes it possible for authenticated attackers, with...

CVE-2026-1255

The YS LeadGen plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4 due to the 'ysleadgengetcaptureddata' AJAX action being accessible to unauthenticated users. This makes it possible for unauthenticated attackers to retrieve all capture...

CVE-2026-1256

YS LeadGen – Popups, Opt-ins & Lead Capture for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.1.4 due to missing capability checks on popup management AJAX endpoints. Authenticated users with Subscriber-level or higher access can create arbitra...

CVE-2026-1256 YS LeadGen – Popups, Opt-ins & Lead Capture <= 2.1.4 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via User Input

The YS LeadGen plugin for WordPress is vulnerable to authorization bypass and Stored Cross-Site Scripting via multiple AJAX endpoints in all versions up to, and including, 2.1.4 due to missing capability checks on popup management actions. This makes it possible for authenticated attackers, with...

CVE-2026-1256 YS LeadGen – Popups, Opt-ins & Lead Capture <= 2.1.4 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via User Input

The YS LeadGen plugin for WordPress is vulnerable to authorization bypass and Stored Cross-Site Scripting via multiple AJAX endpoints in all versions up to, and including, 2.1.4 due to missing capability checks on popup management actions. This makes it possible for authenticated attackers, with...

EUVD-2026-83567

The YS LeadGen plugin for WordPress is vulnerable to authorization bypass and Stored Cross-Site Scripting via multiple AJAX endpoints in all versions up to, and including, 2.1.4 due to missing capability checks on popup management actions. This makes it possible for authenticated attackers, with...

EUVD-2026-83564

The YS LeadGen plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4 due to the 'ysleadgengetcaptureddata' AJAX action being accessible to unauthenticated users. This makes it possible for unauthenticated attackers to retrieve all capture...

CVE-2026-1255

CVE-2026-1255 affects the YS LeadGen WordPress plugin (Popups, Opt-ins & Lead Capture) in all versions up to and including 2.1.4 . The vulnerability is an unauthenticated information disclosure in the ysleadgen_get_captured_data AJAX action, which is accessible without authentication. This allows...

CVE-2026-1255 YS LeadGen – Popups, Opt-ins & Lead Capture <= 2.1.4 - Unauthenticated Information Disclosure in 'ysleadgen_get_captured_data' AJAX Action

The YS LeadGen plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4 due to the 'ysleadgengetcaptureddata' AJAX action being accessible to unauthenticated users. This makes it possible for unauthenticated attackers to retrieve all capture...

CVE-2026-1255 YS LeadGen – Popups, Opt-ins & Lead Capture <= 2.1.4 - Unauthenticated Information Disclosure in 'ysleadgen_get_captured_data' AJAX Action

The YS LeadGen plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4 due to the 'ysleadgengetcaptureddata' AJAX action being accessible to unauthenticated users. This makes it possible for unauthenticated attackers to retrieve all capture...

PT-2026-95799

Name of the Vulnerable Software and Affected Versions YS LeadGen versions prior to 2.1.5 Description The plugin is subject to sensitive information exposure because the ysleadgen get captured data AJAX action is accessible to unauthenticated users. This allows an attacker to retrieve all captured...

PT-2026-95800

Name of the Vulnerable Software and Affected Versions YS LeadGen versions prior to 2.1.5 Description An authorization bypass and Stored Cross-Site Scripting XSS issue exists due to missing capability checks on popup management actions. Authenticated users with Subscriber-level access or higher ca...

CVE-2026-1255: Exposure of Sensitive Information to an Unauthorized Actor

The YS LeadGen plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4 due to the 'ysleadgengetcaptureddata' AJAX action being accessible to unauthenticated users. This makes it possible for unauthenticated attackers to retrieve all capture...

CVE-2026-1256: Improper Neutralization of Input During Web Page Generation

The YS LeadGen plugin for WordPress is vulnerable to authorization bypass and Stored Cross-Site Scripting via multiple AJAX endpoints in all versions up to, and including, 2.1.4 due to missing capability checks on popup management actions. This makes it possible for authenticated attackers, with...