CVE-2026-14556

The HappyForms WordPress plugin before 1.26.15 does not sanitise or escape a user-controlled referral value before embedding it in the form notification email, allowing unauthenticated attackers to inject arbitrary HTML into the emails site administrators receive...

EUVD-2026-107147

The HappyForms WordPress plugin before 1.26.15 does not sanitise or escape a user-controlled referral value before embedding it in the form notification email, allowing unauthenticated attackers to inject arbitrary HTML into the emails site administrators receive...

PT-2026-120505

The HappyForms WordPress plugin before 1.26.15 does not sanitise or escape a user-controlled referral value before embedding it in the form notification email, allowing unauthenticated attackers to inject arbitrary HTML into the emails site administrators receive...

WordPress Responsive Blocks plugin < 2.3.0 - Unauthenticated HTML Injection in Form Notification Email vulnerability

Unauthenticated HTML Injection in Form Notification Email vulnerability discovered by Amin Guliyev in WordPress Plugin Responsive Blocks versions 2.3.0...

WordPress Royal Addons for Elementor plugin < 1.7.1067 - Unauthenticated Stored HTML Injection in Form Notification Emails vulnerability

Unauthenticated Stored HTML Injection in Form Notification Emails vulnerability discovered by Brian Willows in WordPress Plugin Royal Elementor Addons versions 1.7.1067...

Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template

Impact The default "automagic" form notification email rendered user-submitted values without escaping, allowing an unauthenticated form submitter to inject HTML into the notification emails sent to the configured recipients Patches This has been fixed in 5.74.3 and 6.24.2...

CVE-2026-71435 Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.3 and 6.24.2, the default "automagic" form notification email rendered user-submitted values without escaping, allowing an unauthenticated form submitter to inject HTML into the notification emails sent to the...

CVE-2026-71435

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.3 and 6.24.2, the default "automagic" form notification email rendered user-submitted values without escaping, allowing an unauthenticated form submitter to inject HTML into the notification emails sent to the...

CVE-2026-71435: Improper Neutralization of Input During Web Page Generation

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.3 and 6.24.2, the default "automagic" form notification email rendered user-submitted values without escaping, allowing an unauthenticated form submitter to inject HTML into the notification emails sent to the...

PT-2026-68803

Name of the Vulnerable Software and Affected Versions Statamic versions prior to 5.74.3 Statamic versions prior to 6.24.2 Description The default form notification email renders user-submitted values without proper escaping. This allows an unauthenticated user to inject HTML into the notification...