CVE-2026-14556

The HappyForms WordPress plugin before 1.26.15 does not sanitise or escape a user-controlled referral value before embedding it in the form notification email, allowing unauthenticated attackers to inject arbitrary HTML into the emails site administrators receive...

CVE-2026-14556 HappyForms < 1.26.15 - Unauthenticated HTML Injection in Admin Notification Email via client_referer

The HappyForms WordPress plugin before 1.26.15 does not sanitise or escape a user-controlled referral value before embedding it in the form notification email, allowing unauthenticated attackers to inject arbitrary HTML into the emails site administrators receive...

CVE-2026-14556

The HappyForms WordPress plugin (versions before 1.26.15 ) is vulnerable to unauthenticated HTML injection . The root cause is the failure to sanitize or escape a user-controlled referral value (client_referer) before embedding it into form notification emails. This allows unauthenticated attacke...

CVE-2026-14556 HappyForms < 1.26.15 - Unauthenticated HTML Injection in Admin Notification Email via client_referer

The HappyForms WordPress plugin before 1.26.15 does not sanitise or escape a user-controlled referral value before embedding it in the form notification email, allowing unauthenticated attackers to inject arbitrary HTML into the emails site administrators receive...

EUVD-2026-107147

The HappyForms WordPress plugin before 1.26.15 does not sanitise or escape a user-controlled referral value before embedding it in the form notification email, allowing unauthenticated attackers to inject arbitrary HTML into the emails site administrators receive...

WordPress HappyForms plugin < 1.26.15 - Unauthenticated HTML Injection in Admin Notification Email vulnerability

Unauthenticated HTML Injection in Admin Notification Email vulnerability discovered by minaruzzaman shovon in WordPress Plugin Happyforms versions 1.26.15...

CVE-2026-105999

The Booking Package WordPress plugin before 1.7.31 does not perform authorization checks before returning calendar-account configuration in a response, allowing unauthenticated users to disclose sensitive settings including the administrator's notification email addresses...

EUVD-2026-107056

The Booking Package WordPress plugin before 1.7.31 does not perform authorization checks before returning calendar-account configuration in a response, allowing unauthenticated users to disclose sensitive settings including the administrator's notification email addresses...

PT-2026-120505

The HappyForms WordPress plugin before 1.26.15 does not sanitise or escape a user-controlled referral value before embedding it in the form notification email, allowing unauthenticated attackers to inject arbitrary HTML into the emails site administrators receive...

PT-2026-120451

The Booking Package WordPress plugin before 1.7.31 does not perform authorization checks before returning calendar-account configuration in a response, allowing unauthenticated users to disclose sensitive settings including the administrator's notification email addresses...

CVE-2026-97315 Responsive Blocks < 2.3.0 - Unauthenticated HTML Injection in Form Notification Email

The Responsive Blocks WordPress plugin before 2.3.0 does not sanitise or escape some of the values submitted with its Form block before adding them to the HTML notification email sent to the site owner, allowing unauthenticated users to inject arbitrary HTML, such as phishing links, into that ema...

WordPress Responsive Blocks plugin < 2.3.0 - Unauthenticated HTML Injection in Form Notification Email vulnerability

Unauthenticated HTML Injection in Form Notification Email vulnerability discovered by Amin Guliyev in WordPress Plugin Responsive Blocks versions 2.3.0...

CVE-2026-97315

The Responsive Blocks WordPress plugin, in versions before 2.3.0 , is vulnerable to unauthenticated HTML injection . The flaw exists because the plugin fails to properly sanitize or escape certain values submitted via its Form block before including them in HTML notification emails sent to the si...

PT-2026-84625

The CatalogX WordPress plugin before 6.1.3 does not sanitise or escape content that an unauthenticated user can store before including it in the product enquiry notification email sent to the site administrator, allowing unauthenticated attackers to inject arbitrary content into that email, which...

CVE-2026-18777

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to change the status of arbitrary appointments, as well as to trigger notification emails to the affected customers...

CVE-2026-18777

The TrueBooker WordPress plugin (versions before 1.2.7 ) is vulnerable to an unauthenticated arbitrary appointment status change due to improper authorization checks in an AJAX action (specifically the update_appointment_status functionality). An unauthenticated attacker can exploit this flaw to ...

CVE-2026-18777 TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Arbitrary Appointment Status Change via update_appointment_status

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to change the status of arbitrary appointments, as well as to trigger notification emails to the affected customers...

CVE-2026-75082: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

A flaw has been found in Webkul Bagisto up to 2.4.4. The affected element is an unknown function of the file /customer/register of the component Customer-Registration Notification Email. This manipulation of the argument firstname/lastname causes basic cross site scripting. It is possible to...

CVE-2026-14857

The WP Crowdfunding WordPress plugin versions prior to 2.2.1 is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The plugin fails to verify campaign ownership, allowing any authenticated user—including those with the Subscriber role—to modify the update history of campaigns belongin...

CVE-2026-14857 WP Crowdfunding < 2.2.1 - Subscriber+ Campaign Update Modification via IDOR

The WP Crowdfunding WordPress plugin before 2.2.1 does not verify ownership of a campaign before allowing its update history to be modified and a notification email sent to its backers, allowing any authenticated users such as Subscribers to alter other users' campaigns...