Ys Leadgen – Popup Builder, Popup Maker & Form Builder For Wordpress | Lead Generation, Email Marketing, Sales, Conversions, Opt Ins & Subscribers
Approved changes feed: RSS · Atom
cpe:2.3:a:ysinnovations:ys_leadgen_–_popup_builder,_popup_maker_&_form_builder_for_wordpress_|_lead_generation,_email_marketing,_sales,_conversions,_opt-ins_&_subscribers:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Ysinnovations (fbf3ca80-13c1-50a3-b3b2-99d0d93358d1) |
|---|---|
| Product | Ys Leadgen – Popup Builder, Popup Maker & Form Builder For Wordpress | Lead Generation, Email Marketing, Sales, Conversions, Opt Ins & Subscribers (eb73d109-00a9-5846-bcc7-2716763be047) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-1256 |
vulnerable | 2026-10-13 12:29:27.332569 |
YS LeadGen – Popups, Opt-ins & Lead Capture <= 2.1.4 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via User Input
MEDIUM (6.4)
The YS LeadGen plugin for WordPress is vulnerable to authorization bypass and Stored Cross-Site Scripting via multiple AJAX endpoints in all versions up to, and including, 2.1.4 due to missing capability checks on popup management actions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary popups and inject malicious JavaScript that executes when the popup is displayed, leading to Stored XSS.
Published: 2026-09-19T08:27:23.235Z
Updated: 2026-09-19T13:51:19.044Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-1255 |
vulnerable | 2026-10-13 12:29:26.634759 |
YS LeadGen – Popups, Opt-ins & Lead Capture <= 2.1.4 - Unauthenticated Information Disclosure in 'ysleadgen_get_captured_data' AJAX Action
HIGH (7.5)
The YS LeadGen plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4 due to the 'ysleadgen_get_captured_data' AJAX action being accessible to unauthenticated users. This makes it possible for unauthenticated attackers to retrieve all captured form submission data, including personally identifiable information (PII) such as names, email addresses, and message content submitted through YS LeadGen forms.
Published: 2026-09-19T08:27:22.176Z
Updated: 2026-09-19T13:51:19.555Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.