CVE-2026-14556 HappyForms < 1.26.15 - Unauthenticated HTML Injection in Admin Notification Email via client_referer

The HappyForms WordPress plugin before 1.26.15 does not sanitise or escape a user-controlled referral value before embedding it in the form notification email, allowing unauthenticated attackers to inject arbitrary HTML into the emails site administrators receive...

CVE-2026-14556

The HappyForms WordPress plugin (versions before 1.26.15 ) is vulnerable to unauthenticated HTML injection . The root cause is the failure to sanitize or escape a user-controlled referral value (client_referer) before embedding it into form notification emails. This allows unauthenticated attacke...