CVE-2026-1256

MediumCVSS 6.4/10Last modified Sep 21, 2026

Description

The YS LeadGen plugin for WordPress is vulnerable to authorization bypass and Stored Cross-Site Scripting via multiple AJAX endpoints in all versions up to, and including, 2.1.4 due to missing capability checks on popup management actions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary popups and inject malicious JavaScript that executes when the popup is displayed, leading to Stored XSS.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Sep 19, 2026
Last modified
Sep 21, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-125604.4The Editorial Rating – Product Review & Rating System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'Link URL' FieldCVE-2026-125616.4The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the vc_raw_html shortcode in all versions up to anCVE-2026-1256128.8Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Deltaww DIAEnergie allows SQL InjectioCVE-2026-125628.8The RCU II+ and Multiload II+ are vulnerable to an unauthenticated service that exposes a debug interface granting full root-level access CVE-2026-1256377.2A flaw was found in the Konflux UI proxy. Hostname values defined in the KonfluxUI custom resource are inserted directly into proxy configurCVE-2026-125649.6A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetes_auth() function in awx_plugins/credentials/hashivCVE-2026-125655.3The unarchive internal module's archive extraction commands perform no code-level validation on extracted file paths, relying entirely on thCVE-2026-1256526.8A flaw was found in the keycloak-services component of Keycloak, which provides the core authentication and authorization logic for the idenCVE-2026-125663.1The docker_pull module uses the realm parameter from a Docker registry's WWW-Authenticate response header as the authentication endpoint witCVE-2026-125672.2The github_workflows module constructs local directory paths from user-controlled repository names without validating for symlinks. A local CVE-2026-1256726.6A flaw was found in cockpit-storaged. A Tang keyserver address read from a clevis token in a LUKS header is concatenated into curl's argumenCVE-2026-125686.5The postman_download module uses the workspace name field from the Postman API to construct the local directory path without sanitization. I