rootpwn

high · CVSS v3 7.5 · EPSS 0.00295

CVE-2026-1255

The YS LeadGen plugin for WordPress allows unauthenticated users to retrieve sensitive form data via the ysleadgen_get_captured_data AJAX ac

Overview

The YS LeadGen plugin for WordPress allows unauthenticated users to retrieve sensitive form data via the ysleadgen_get_captured_data AJAX action. This flaw exposes PII such as names, emails, and messages. It affects all versions up to 2.1.4.

Description

The YS LeadGen plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4 due to the 'ysleadgen_get_captured_data' AJAX action being accessible to unauthenticated users. This makes it possible for unauthenticated attackers to retrieve all captured form submission data, including personally identifiable information (PII) such as names, email addresses, and message content submitted through YS LeadGen forms.

Impact

Confidentiality: PII exposed. Integrity: data not tampered but exposed. Availability: no direct impact. Defenders: site owners, administrators, and users whose data is collected via YS LeadGen forms.

Remediation

Update YS LeadGen to version 2.1.5 or later. If update not possible, disable the ysleadgen_get_captured_data AJAX endpoint or restrict it to authenticated users. Monitor logs for unauthorized access.

Risk context

High severity CVE with low EPSS (0.00295) indicates a moderate likelihood of exploitation but significant impact if exploited.

Affected products

  • WordPress YS LeadGen plugin

Scores

Severity
high
CVSS v2
7.8
CVSS v3
7.5
CVSS v4
—
EPSS
0.00295

wordpress plugin sensitive-information-exposure PII unauthenticated ajax data-exposure

← All CVEs

Related CVEs

high

CVE-2026-82672

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in elixir-mint mint allows a malicious HTTP/1 server to desynchronize a strict intermediary and the Mint client on a pooled connection, enabling response-queue poisoning against subsequent requests that share the connection. Mint.HTTP1.Parse.chunk_size/1 in lib/mint/http1/parse.ex stops at the first non-hexadecimal byte of a chunked response's chunk-size line and returns the remainder unexamined. Mint.HTTP1.decode_body/5 in lib/mint/http1.ex then discards every byte up to the CRLF with Parse.ignore_until_crlf/1, so the accepted grammar is a run of hex digits followed by arbitrary bytes, where RFC 9112 permits only a ;-introduced chunk extension. Lines such as 5ZZZZZ and 5 9 are accepted as chunk size 5, and 0ZZZZ is accepted as the terminating chunk that ends the message body. An RFC-strict intermediary rejects such a line while Mint accepts it, so the two disagree on chunk boundaries and on where the response ends. This issue affects mint: from 0.1.0 before 1.10.1.

View analysis

high

CVE-2026-93988

QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read arbitrary files. Attackers can supply relative path sequences in the email parameter to bypass directory restrictions and access sensitive files including database credentials and configuration data.

View analysis

high

CVE-2026-93990

Expat through 2.8.4 fails to validate low surrogates following high surrogates in UTF-16 input, allowing malformed UTF-16 sequences to be accepted. Attackers can craft UTF-16 encoded XML with lone high surrogates that consume following code units, hiding markup characters from the parser and enabling XML injection attacks.

View analysis

high

CVE-2026-93991

Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vulnerability in ListArchivedWorkflows that fails to apply cluster-scoped access review when the metadata.namespace field selector uses the NotEquals operator. Attackers with namespace-scoped list permissions can use a negated namespace field selector to retrieve archived workflows from all other namespaces, exposing spec arguments, parameter values, and annotations.

View analysis