YS LeadGen EUVD-2026-83567

Requires an authenticated WordPress account at Subscriber level or above (PR:L) on a site running YS LeadGen (Popup Builder / Popup Maker / Form Builder) version 2.1.4 or earlier; the affected AJAX popup-management actions in app/Controllers/Ajax.php lack capability checks. Practical exploitation is most viable where the site allows open/self-service user registration, which is how an attacker obtains the required Subscriber account. Payload execution (the stored XSS) further requires a victim - typically an administrator or visitor - to view or trigger display of the attacker-created popup, making user interaction of a third party a real-world dependency for impact even though the CVSS marks UI:N for the injection itself.

This is a moderate-severity, authenticated stored XSS with broken access control. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, 6.4) is internally consistent and matches Wordfence's standard scoring for a Subscriber-level stored XSS with a scope change (S:C, reflecting script execution in another user's browser context, typically an admin viewing the popup). No EPSS score, no CISA KEV listing, and no public POC are present in the input - so this is 'no public exploit identified at time of analysis.' The gating factor PR:L is significant: exploitation requires a valid authenticated account (Subscriber and above). Real-world priority is therefore driven by whether the affected site permits open user registration; on sites where registration is closed, the practical attack surface shrinks considerably. Impacts are capped at C:L/I:L (partial, via client-side script) with A:N, so this is a real but not critical issue - not a high-CVSS-but-hollow finding, but also not a drop-everything remote-unauth flaw. No key signals conflict; the main absence is any exploitation-probability data (EPSS/KEV/POC all unavailable), which limits confidence about likelihood of opportunistic exploitation.

An attacker registers a low-privilege Subscriber account on a WordPress site running YS LeadGen <=2.1.4, then calls the unprotected popup-management AJAX endpoints (app/Controllers/Ajax.php) to create a popup containing malicious JavaScript. When an administrator or visitor triggers the popup display, the script executes in their browser session, enabling session/cookie theft or admin-action forgery leading to site takeover. No public POC is identified at time of analysis; the attack is network-based and low-complexity but requires an authenticated account.