rootpwn

medium · CVSS v3 6.4 · EPSS 0.00204

CVE-2026-1256

The YS LeadGen plugin for WordPress is vulnerable to authorization bypass and Stored Cross-Site Scripting via multiple A…

Description

The YS LeadGen plugin for WordPress is vulnerable to authorization bypass and Stored Cross-Site Scripting via multiple AJAX endpoints in all versions up to, and including, 2.1.4 due to missing capability checks on popup management actions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary popups and inject malicious JavaScript that executes when the popup is displayed, leading to Stored XSS.

Scores

Severity
medium
CVSS v2
5.5
CVSS v3
6.4
CVSS v4
—
EPSS
0.00204

← All CVEs

Related CVEs

medium

CVE-2026-93956

A flaw has been found in olivier-ls PHP-FTS up to 1.1.2. Affected by this issue is the function SearchEngine::buildHighlights of the file src/SearchEngine.php of the component Search Engine. Executing a manipulation of the argument Query can lead to cross site scripting. The attack may be launched remotely. The exploit has been published and may be used. Upgrading to version 1.1.3 can resolve this issue. This patch is called 0b2fae333d6b022da7ed4c43e2d41aa03f91dff3. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

View analysis

medium

CVE-2026-93957

A vulnerability has been found in olivier-ls PHP-FTS up to 1.1.3. This affects the function SearchEngine::matchesSingleFilter of the file src/SearchEngine.php of the component Filter Matching. The manipulation leads to incorrect comparison. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.4 is able to mitigate this issue. The identifier of the patch is 0b2fae333d6b022da7ed4c43e2d41aa03f91dff3. It is suggested to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

View analysis

medium

CVE-2026-75959

The GoPay for WooCommerce plugin for WordPress has a SQL injection vulnerability in the log_table_filter parameter. Authenticated shop managers can inject arbitrary SQL to read sensitive data. This affects all versions up to 1.0.36.

View analysis

medium

CVE-2026-18346

The TikTok plugin for WordPress (up to 1.4.1) contains an authorization bypass that lets unauthenticated users overwrite the stored TikTok access token. This can lead to hijacking of the site’s TikTok Business and product catalog integration. The flaw requires a valid TikTok OAuth auth_code but is otherwise easy to trigger.

View analysis