HappyForms vulnerabilities
CVEs whose affected-version data names the HappyForms package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-14556Medium· 5.4HappyForms < 1.26.15 - Unauthenticated HTML Injection in Admin Notification Email via client_referer
The HappyForms WordPress plugin before 1.26.15 does not sanitise or escape a user-controlled referral value before embedding it in the form notification email, allowing unauthenticated attackers to inject arbitrary HTML into the emails s…
▾ Sunlitvia CVEORG
CVE-2026-97065High· 7.1Unauthenticated Cross Site Scripting (XSS) in Happyforms <= 1.26.15 versions.
Unauthenticated Cross Site Scripting (XSS) in Happyforms <= 1.26.15 versions.
▾ TwilightHappyforms · happyformsEPSS 0.18%via NVD