CVE-2026-1256 - YS LeadGen – Popups, Opt-ins & Lead Capture = 2.1.4 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via User Input
Brief
CVE ID : CVE-2026-1256
Published : Sept. 19, 2026, 9:16 a. m.
- 11 hours, 40 minutes ago
Description : The YS LeadGen plugin for WordPress is vulnerable to authorization bypass and Stored Cross-Site Scripting via multiple AJAX endpoints in all versions up to, and including, 2.
- 4 due to missing capability checks on popup management actions.
This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary popups and inject malicious JavaScript that executes when the popup is displayed, leading to Stored XSS.
Severity: 6.4
- MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...