CVE-2026-1256: YS LeadGen – Popups, Opt-ins & Lead Capture <= 2.1.4 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via User Input
The YS LeadGen plugin for WordPress is vulnerable to authorization bypass and Stored Cross-Site Scripting via multiple AJAX endpoints in all versions up to, and including, 2.1.4 due to missing capability checks on popup management actions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary popups and inject malicious JavaScript that executes when the popup is displayed, leading to Stored XSS.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress YS LeadGen pluginto a version that resolves this vulnerability.Fixed in 2.1.4 - Configuration
Update the plugin so every affected popup management AJAX action validates the caller has the required capability; do not rely on Subscriber-level access for popup creation/management.
WordPress YS LeadGen plugin Capability checks on popup management AJAX endpoints = Require appropriate user capabilities before allowing popup creation/management actions for all authenticated requests (Subscriber+)
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated WordPress account with Subscriber-level access or higher. They can use affected AJAX popup-management actions without the intended capability checks.
What is the impact of successful exploitation?
An attacker can create arbitrary popups containing malicious JavaScript. The script executes for users when the injected popup is displayed, potentially exposing or modifying data available in those users' browser sessions.
Which installations are affected?
YS LeadGen versions through 2.1.4, including 2.1.4, are affected. Exploitation requires that an attacker can authenticate to the WordPress site with at least a Subscriber account.