What’s Vulnerable › Vulnerabilities

CVE-2026-1255: YS LeadGen – Popups, Opt-ins & Lead Capture <= 2.1.4 - Unauthenticated Information Disclosure in 'ysleadgen_get_captured_data' AJAX Action

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-19 · updated 2026-09-21
• Weakness: CWE-200

Description

The YS LeadGen plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4 due to the 'ysleadgen_get_captured_data' AJAX action being accessible to unauthenticated users. This makes it possible for unauthenticated attackers to retrieve all captured form submission data, including personally identifiable information (PII) such as names, email addresses, and message content submitted through YS LeadGen forms.

Affected products

• ysinnovations YS LeadGen – Popup Builder, Popup Maker & Form Builder for WordPress | Lead Generation, Email Marketing, S: through 2.1.4

References

• https://plugins.trac.wordpress.org/browser/ysleadgen/tags/1.1.1/app/Controllers/Ajax.php#L65
• https://plugins.trac.wordpress.org/changeset/3577391
• https://www.wordfence.com/threat-intel/vulnerabilities/id/66ca4e6a-e489-4c86-a9d4-1eb89c97cc1c?source=cve

Get alerted when CVE-2026-1255 or the next vulnerability affects your stack