CVE-2026-1256

YS LeadGen – Popups, Opt-ins & Lead Capture for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.1.4 due to missing capability checks on popup management AJAX endpoints. Authenticated users with Subscriber-level or higher access can create arbitra...

EUVD-2026-83567

The YS LeadGen plugin for WordPress is vulnerable to authorization bypass and Stored Cross-Site Scripting via multiple AJAX endpoints in all versions up to, and including, 2.1.4 due to missing capability checks on popup management actions. This makes it possible for authenticated attackers, with...

EUVD-2026-83564

The YS LeadGen plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4 due to the 'ysleadgengetcaptureddata' AJAX action being accessible to unauthenticated users. This makes it possible for unauthenticated attackers to retrieve all capture...

CVE-2026-1255

CVE-2026-1255 affects the YS LeadGen WordPress plugin (Popups, Opt-ins & Lead Capture) in all versions up to and including 2.1.4 . The vulnerability is an unauthenticated information disclosure in the ysleadgen_get_captured_data AJAX action, which is accessible without authentication. This allows...