CVE-2026-1256 ysinnovations CVE debrief

Who should care

Defenders responsible for WordPress installations with the YS LeadGen plugin should assess exposure and prioritize patching or mitigating this vulnerability, especially for installations with untrusted users.

Why it matters

The YS LeadGen plugin for WordPress has a vulnerability that allows authenticated attackers to create arbitrary popups and inject malicious JavaScript, leading to Stored Cross-Site Scripting (XSS). Defenders should prioritize patching or mitigating this vulnerability, especially for WordPress installations with untrusted users.

• Authenticated attackers with Subscriber-level access can create arbitrary popups and inject malicious JavaScript.
• The vulnerability allows for Stored Cross-Site Scripting (XSS) attacks.
• Defenders need to verify the version of the YS LeadGen plugin and patch or update to a fixed version.
• The vulnerability requires verification of WordPress installation configurations and user access controls.

Technical summary

The YS LeadGen plugin for WordPress is vulnerable to authorization bypass and Stored Cross-Site Scripting via multiple AJAX endpoints in all versions up to, and including, 2.1.4 due to missing capability checks on popup management actions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary popups and inject malicious JavaScript that executes when the popup is displayed, leading to Stored XSS. The vulnerability requires verification of WordPress installation configurations and user access controls.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially for WordPress installations with untrusted users.

Recommended defensive actions

• Patch or update the YS LeadGen plugin to a version that fixes the vulnerability.
• Restrict access to the WordPress installation to trusted users only.
• Monitor for suspicious activity, such as unusual popup creation or JavaScript injection.
• Verify the version of the YS LeadGen plugin and patch or update to a fixed version.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability exists in all versions of the YS LeadGen plugin up to and including 2.1.4. The plugin lacks capability checks on popup management actions, allowing authenticated attackers to create arbitrary popups and inject malicious JavaScript.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.