CVE-2026-1256

Name of the Vulnerable Software and Affected Versions YS LeadGen versions prior to 2.1.5

Description An authorization bypass and Stored Cross-Site Scripting (XSS) issue exists due to missing capability checks on popup management actions. Authenticated users with Subscriber-level access or higher can exploit multiple AJAX endpoints to create arbitrary popups and inject malicious JavaScript. This script executes when the popup is displayed to other users. Stored XSS is a type of vulnerability where a malicious script is permanently stored on the target server.

Recommendations Update the plugin to a version newer than 2.1.4.