CVE-2026-1255

Name of the Vulnerable Software and Affected Versions YS LeadGen versions prior to 2.1.5

Description The plugin is subject to sensitive information exposure because the ysleadgen get captured data AJAX action is accessible to unauthenticated users. This allows an attacker to retrieve all captured form submission data, including personally identifiable information (PII) such as names, email addresses, and message content.

Recommendations Update the plugin to a version newer than 2.1.4. As a temporary mitigation, restrict access to the ysleadgen get captured data AJAX action.