Lenix Leads Collector

Lenix Leads Collector has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it is fixed as of October 2026. Their average CVSS score is 7.2, and the most serious one scores 7.2 out of 10. Severity breakdown: 0 critical and 1 high.

The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).

The one issue recorded for Lenix Leads Collector has a vendor fix available, so running the current release closes it.

All of these findings were reported by Webbernaut. Lenix Leads Collector is installed on roughly 10,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

Strategic Overview

Avg CVSSHigh
7.2/ 10
Patch Coverage100%
Open

0

Fixed

1

Get automatic notifications for all Lenix Leads Collector vulnerabilities before they are exploited.

Highest severity on recordCVSS 7.2CVE-2025-1039

Lenix Elementor Leads addon <= 1.8.2 - Unauthenticated Stored Cross-Site Scripting via URL Form Field

Read the full analysis

Vulnerability Records

1 records
Lenix Leads Collector banner
Latestv2.1.0

Lenix Leads Collector

yonifre

Author

yonifre

4.4(25)
88/100
Last Updated
2026-10-22 (6d ago)
Active Installs
10,000+
Downloads
194,872
Requires WP
5.0+
Requires PHP
7.0+
Tested up to
WP 7.1.3
Created
2017-09-27 (9y ago)

Lenix Leads Collector keeps every form submission on your site in one place, so a lead is never lost to a failed email. Install it and it starts collecting – no configuration needed. It works with Elementor Pro forms, Hello Plus forms, Contact Form 7 and WPForms (Lite and Pro), including Elementor global forms. Collect Automatically stores every submission as a lead (a private post type – never public on your front end) Remembers where the lead came from: UTM parameters, referrer, first landing page, IP address and browser Optional cross-page source tracking using a small first-party cookie (can be switched off) Manage One list for all leads, plus a “Leads by form” overview with lead counts Lead statuses with colors (New, In Progress, Completed, Spam – or create your own) and quick status change from the list Bulk actions: change the status of many leads at once Filter by status and date range, and search inside the form values (names, emails, phones, messages – Hebrew and other languages included) Internal notes, phone call and SMS log, and email replies sent straight from the lead screen, with full response history Custom fields for your own data on each lead (for example “budget” or “assigned to”) Decide who can view leads and who can edit them (Subscribers up to Administrators) Export Export a form’s leads to CSV, optionally by date range and status Export only the leads you selected Spreadsheet-safe: values that could be run as formulas are neutralized Hebrew and other UTF-8 text opens correctly in Excel Privacy and security Form data is sanitized on save and escaped on output Every action is protected by nonces and capability checks Each lead is a normal WordPress post, so you can delete a lead whenever you need to (right to erasure) Optional automatic deletion of leads older than a number of days Lead data stays in your own database – nothing is sent to external servers Available in English, Hebrew and French. Also by us: Maspik – Spam Protection Getting lots of junk submissions? Our sister plugin Maspik blocks spam in Elementor, CF7, WPForms and many other form plugins without CAPTCHA, so only real leads reach Leads Collector.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C