Stored Cross-Site Scripting in LeadBI Plugin for WordPress

CVE-2026-1189

What is CVE-2026-1189?

The LeadBI Plugin for WordPress is susceptible to Stored Cross-Site Scripting (XSS) vulnerabilities due to inadequate input sanitization and output escaping practices. Specifically, the 'form_id' parameter within the 'leadbi_form' shortcode can be exploited by authenticated users with Contributor-level access and higher. Malicious scripts can be injected, and if successfully executed, this could lead to unauthorized actions or data exposure when users interact with manipulated pages. It is crucial for site administrators to update to the latest version or implement mitigation strategies to safeguard their sites.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References