CVE-2026-14556

The HappyForms WordPress plugin before 1.26.15 does not sanitise or escape a user-controlled referral value before embedding it in the form notification email, allowing unauthenticated attackers to inject arbitrary HTML into the emails site administrators receive...

CVE-2026-14556 HappyForms < 1.26.15 - Unauthenticated HTML Injection in Admin Notification Email via client_referer

The HappyForms WordPress plugin before 1.26.15 does not sanitise or escape a user-controlled referral value before embedding it in the form notification email, allowing unauthenticated attackers to inject arbitrary HTML into the emails site administrators receive...

CVE-2026-14556 HappyForms < 1.26.15 - Unauthenticated HTML Injection in Admin Notification Email via client_referer

The HappyForms WordPress plugin before 1.26.15 does not sanitise or escape a user-controlled referral value before embedding it in the form notification email, allowing unauthenticated attackers to inject arbitrary HTML into the emails site administrators receive...

CVE-2026-14556

The HappyForms WordPress plugin (versions before 1.26.15 ) is vulnerable to unauthenticated HTML injection . The root cause is the failure to sanitize or escape a user-controlled referral value (client_referer) before embedding it into form notification emails. This allows unauthenticated attacke...

WordPress HappyForms plugin < 1.26.15 - Unauthenticated HTML Injection in Admin Notification Email vulnerability

Unauthenticated HTML Injection in Admin Notification Email vulnerability discovered by minaruzzaman shovon in WordPress Plugin Happyforms versions 1.26.15...

EUVD-2026-107147

The HappyForms WordPress plugin before 1.26.15 does not sanitise or escape a user-controlled referral value before embedding it in the form notification email, allowing unauthenticated attackers to inject arbitrary HTML into the emails site administrators receive...

PT-2026-120505

The HappyForms WordPress plugin before 1.26.15 does not sanitise or escape a user-controlled referral value before embedding it in the form notification email, allowing unauthenticated attackers to inject arbitrary HTML into the emails site administrators receive...

CVE-2026-97065

Unauthenticated Cross Site Scripting XSS in Happyforms = 1.26.15 versions...

CVE-2026-97065 WordPress Happyforms plugin <= 1.26.15 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Happyforms = 1.26.15 versions...

CVE-2026-97065 WordPress Happyforms plugin <= 1.26.15 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Happyforms = 1.26.15 versions...

EUVD-2026-89891

Unauthenticated Cross Site Scripting XSS in Happyforms = 1.26.15 versions...

CVE-2026-97065

The Happyforms WordPress plugin versions

PT-2026-103223

Unauthenticated Cross Site Scripting XSS in Happyforms = 1.26.15 versions...

CVE-2026-97065: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Happyforms = 1.26.15 versions...

WordPress Happyforms plugin <= 1.26.15 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Dthangws in WordPress Plugin Happyforms versions = 1.26.15...

CVE-2025-11977

The Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.26.12 via the happyformsgetformpartial function. This makes it possible for authenticat...

CVE-2025-11977

The Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.26.12 via the happyformsgetformpartial function. This makes it possible for authenticat...

CVE-2025-11977 HappyForms <= 1.26.12 - Authenticated (Admin+) Local File Inclusion

The Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.26.12 via the happyformsgetformpartial function. This makes it possible for authenticat...

EUVD-2025-210450

The Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.26.12 via the happyformsgetformpartial function. This makes it possible for authenticat...

CVE-2025-11977 HappyForms <= 1.26.12 - Authenticated (Admin+) Local File Inclusion

The Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.26.12 via the happyformsgetformpartial function. This makes it possible for authenticat...