Form builder to get in touch with visitors, grow your email list and collect payments — Happyforms, CVE-2026-14556

CVE, Research URL: CVE-2026-14556
Home page URL: Security reports for Form builder to get in touch with visitors, grow your email list and collect payments — Happyforms
Application: Form builder to get in touch with visitors, grow your email list and collect payments — Happyforms
Published on: Oct 21, 2026
Research Description: The HappyForms WordPress plugin before 1.26.15 does not sanitise or escape a user-controlled referral value before embedding it in the form notification email, allowing unauthenticated attackers to inject arbitrary HTML into the emails site administrators receive.
Affected versions: max 1.26.15.
Status: vulnerable