CVE-2026-1255: YS LeadGen (WordPress plugin) · Information Exposure
Affects YS LeadGen (WordPress plugin)Source CVE Database V5
Not known to be exploited · CVSS 7.5 High.
Data as of 3 Nov 2026, 10:57 UTC
- EPSS
- 0.5% chance of exploitation in 30 days – higher than 43% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 19 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 3 Nov 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| ysinnovationsYS LeadGen – Popup Builder, Popup Maker & Form Builder for WordPress | Lead Generation, Email Marketing, Sales, Conversions, Opt-Ins & Subscribers | Affected
| Fixed in– |
AI-suggested
Until a fix is available, restrict access to the AJAX action 'ysleadgen_get_captured_data' by implementing authentication or disabling the vulnerable functionality if possible.
Description
The YS LeadGen plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4 due to the 'ysleadgen_get_captured_data' AJAX action being accessible to unauthenticated users. This makes it possible for unauthenticated attackers to retrieve all captured form submission data, including personally identifiable information (PII) such as names, email addresses, and message content submitted through YS LeadGen forms.