Description

The YS LeadGen plugin for WordPress is vulnerable to authorization bypass and Stored Cross-Site Scripting via multiple AJAX endpoints in all versions up to, and including, 2.1.4 due to missing capability checks on popup management actions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary popups and inject malicious JavaScript that executes when the popup is displayed, leading to Stored XSS.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-09-19T09:16:34.163Z",
  "pubdate": "2026-09-19T09:16:34.163Z",
  "executiveSummary": "The YS LeadGen WordPress plugin contains critical vulnerabilities including improper authorization and Stored Cross-Site Scripting (XSS). These flaws exist across all versions up to and including 2.1.4. The vulnerability stems from insufficient capability validation within the plugin's AJAX request handling architecture, allowing lower-privileged users to interact with administrative-level functions.\nSpecifically, authenticated users with Subscriber-level access can perform unauthorized CRUD (Create, Read, Update, Delete) operations on popup entities. By injecting arbitrary JavaScript payloads into these popups, attackers can execute malicious code in the browsers of other users, including site administrators. The risk implication is significant, as it facilitates potential session hijacking, unauthorized administrative actions, or credential theft. Successful exploitation requires an attacker to possess a valid, albeit low-privileged, account on the WordPress installation. There is no requirement for complex social engineering; the threat originates from within the legitimate user base through abuse of improperly secured internal endpoints.",
  "technicalDetails": "The vulnerability originates from a failure to implement robust capability checks (e.g., current_user_can()) within the AJAX action handlers responsible for popup management. In WordPress development, AJAX handlers that perform sensitive operations must verify that the requesting user possesses the necessary administrative privileges before executing the requested logic.\nRoot Cause Analysis: The plugin's AJAX endpoints are defined without proper sanitization or authorization gates, effectively trusting the client-side input. Because these endpoints fail to validate the user's role, a Subscriber-level user can transmit malicious requests directly to the server to create or modify popups. This lack of access control allows an attacker to bypass intended plugin restrictions entirely.\nExploitation Flow: An attacker authenticated as a Subscriber can craft a forged AJAX request targeting the plugin's specific action hooks. By manipulating the request parameters, the attacker can submit content fields meant for popup configurations. Since the server does not enforce capability checks, it processes the request and saves the attacker's payload—which may contain arbitrary JavaScript—into the WordPress database. This stored payload is subsequently rendered on any page where the target popup is deployed.\nPayload Execution: When a victim—particularly an administrator—navigates to a page containing the infected popup, the injected JavaScript executes within the context of the victim's browser session. Because the script runs in the context of the authenticated victim, it can perform actions on behalf of that user. This includes, but is not limited to, making further unauthorized administrative changes, exfiltrating session tokens, or redirecting the user to malicious domains.\nAffected Versions: All versions of the YS LeadGen plugin up to and including 2.1.4. The flaw is inherent in the plugin's architectural design regarding its interaction with the WordPress AJAX API, specifically involving internal endpoints dedicated to popup creation and modification. Because the vulnerability allows for direct interaction with the database layer without administrative verification, it represents a high-risk security deficiency for any WordPress environment utilizing the plugin's standard functionality."
}