Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-1256

YS LeadGen – Popup Builder, Popup Maker & Form Builder for… · cross-site scripting

CVSS 3.1 6.4 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-1256

Published

The YS LeadGen plugin for WordPress is vulnerable to authorization bypass and Stored Cross-Site Scripting via multiple AJAX endpoints in all versions up to, and including, 2.1.4 due to missing capability checks on popup management actions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary popups and inject malicious JavaScript that executes when the popup is displayed, leading to Stored XSS.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-1256

Published

YS LeadGen – Popup Builder, Popup Maker & Form Builder for WordPress | Lead Generation, Email Marketing, Sales, Conversions, Opt-Ins & Subscribers

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "ysinnovations",
                    "product": "YS LeadGen – Popup Builder, Popup Maker & Form Builder for WordPress | Lead Generation, Email Marketing, Sales, Conversions, Opt-Ins & Subscribers",
                    "versions": [
                        {
                            "version": "0",
                            "status": "affected",
                            "lessThanOrEqual": "2.1.4",
                            "versionType": "semver"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON