CVE-2026-1256 in YS LeadGen Plugin
Summary
by MITRE • 09/19/2026
The YS LeadGen plugin for WordPress is vulnerable to authorization bypass and Stored Cross-Site Scripting via multiple AJAX endpoints in all versions up to, and including, 2.1.4 due to missing capability checks on popup management actions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary popups and inject malicious JavaScript that executes when the popup is displayed, leading to Stored XSS.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/19/2026
The YS LeadGen plugin for WordPress contains a critical security flaw affecting all versions up to 2.1.4, characterized by both authorization bypass and stored cross-site scripting vulnerabilities. The root cause of this issue lies in the improper implementation of access controls within multiple AJAX endpoints responsible for popup management actions. Specifically, these endpoints fail to perform adequate capability checks before allowing users to execute administrative functions such as creating or modifying popups. This architectural oversight allows authenticated attackers with subscriber-level access and above to bypass intended restrictions and interact directly with backend processes that should be reserved for higher-privileged roles like administrators or editors.
From a technical perspective, the vulnerability stems from missing validation of user capabilities during AJAX request processing. In WordPress environments, capability checks are essential to ensure that only users with appropriate permissions can perform sensitive operations. By omitting these checks on popup management endpoints, the plugin inadvertently exposes functionality that allows unprivileged users to create arbitrary popups. This lack of enforcement means that any authenticated user, regardless of their actual role or permission level within the application, can trigger actions intended for privileged accounts without encountering authentication barriers or authorization denials.
The operational impact of this vulnerability is severe due to its potential for stored cross-site scripting attacks. Once an attacker successfully creates a popup through the compromised AJAX endpoint, they are able to inject malicious JavaScript code into the content associated with that popup. Because these popups are displayed to other users visiting the site, the injected script executes in the context of those victims' browsers. This leads to persistent data theft, session hijacking, defacement, or redirection attacks against unsuspecting visitors who interact with the compromised page elements. The stored nature of this XSS means that each subsequent view of the affected popup triggers the malicious payload without requiring further interaction from the attacker.
This vulnerability aligns closely with CWE-284 Improper Access Control and CWE-79 Cross-site Scripting: Stored as defined by the Common Weakness Enumeration framework. In terms of adversary tactics, it corresponds to ATT&CK technique T1053 Scheduled Task/Job which can be adapted for persistence mechanisms in web applications, although more directly it maps to privilege escalation via improper authorization checks and subsequent exploitation through client-side code injection. The combination of these flaws creates a high-risk scenario where low-privilege users can escalate their influence over the application environment significantly beyond what was originally intended by the developers or site administrators.
To mitigate this vulnerability, immediate action is required to update the YS LeadGen plugin to version 2.1.5 or later where these authorization checks have been properly implemented. Site administrators should verify that all AJAX endpoints enforce strict capability verification using standard WordPress functions such as current_user_can before executing any administrative logic. Additionally, implementing Content Security Policy headers can help mitigate the impact of stored XSS by restricting script execution sources and reducing the effectiveness of injected payloads even if they manage to bypass other defenses. Regular security audits focusing on input validation and access control mechanisms are recommended to prevent similar issues in future updates or related plugins within the WordPress ecosystem.