Ys Leadgen Popup Builder Popup Maker Form Builder For Wordpress Lead Generation Email Marketing Sales Conversions Opt Ins Subscribers
Monthly
Unauthenticated information disclosure in the YS LeadGen plugin for WordPress (all versions up to and including 2.1.4) lets any remote attacker dump the entire store of captured lead-form submissions by simply invoking the plugin's AJAX action, exposing names, email addresses, and message content of every visitor who filled out a form. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the attack is remote, unauthenticated, and requires no user interaction, and our independent assessment rates it a genuine high-priority issue rather than a high-score-but-low-real-risk case, because the exposed data is directly monetizable PII and the only practical limiter is how much data a given site has collected - not any defensive barrier. No public exploit code and no active exploitation have been identified at time of analysis, but the barrier to abuse is trivially low for anyone able to reach the site.
Authenticated stored cross-site scripting (XSS) in the YS LeadGen WordPress plugin, versions up to and including 2.1.4, allows attackers with Subscriber-level access or higher to bypass authorization checks on AJAX popup-management endpoints and inject arbitrary JavaScript through created popups. The missing capability checks in app/Controllers/Ajax.php enable low-privileged users to create popups containing malicious script, which executes when a victim (such as an administrator or site visitor) views the popup. No public exploit code has been identified at time of analysis, and the CVSS score is 6.4 (medium).
Unauthenticated information disclosure in the YS LeadGen plugin for WordPress (all versions up to and including 2.1.4) lets any remote attacker dump the entire store of captured lead-form submissions by simply invoking the plugin's AJAX action, exposing names, email addresses, and message content of every visitor who filled out a form. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the attack is remote, unauthenticated, and requires no user interaction, and our independent assessment rates it a genuine high-priority issue rather than a high-score-but-low-real-risk case, because the exposed data is directly monetizable PII and the only practical limiter is how much data a given site has collected - not any defensive barrier. No public exploit code and no active exploitation have been identified at time of analysis, but the barrier to abuse is trivially low for anyone able to reach the site.
Authenticated stored cross-site scripting (XSS) in the YS LeadGen WordPress plugin, versions up to and including 2.1.4, allows attackers with Subscriber-level access or higher to bypass authorization checks on AJAX popup-management endpoints and inject arbitrary JavaScript through created popups. The missing capability checks in app/Controllers/Ajax.php enable low-privileged users to create popups containing malicious script, which executes when a victim (such as an administrator or site visitor) views the popup. No public exploit code has been identified at time of analysis, and the CVSS score is 6.4 (medium).