CVE-2026-14556 Details
Description
The HappyForms WordPress plugin before 1.26.15 does not sanitise or escape a user-controlled referral value before embedding it in the form notification email, allowing unauthenticated attackers to inject arbitrary HTML into the emails site administrators receive.
A vulnerability exists in the HappyForms WordPress plugin in versions prior to 1.26.15. The issue arises because the plugin fails to properly sanitize or escape user-controlled referral values before including them in form notification emails. This oversight allows unauthenticated attackers to inject arbitrary HTML into emails received by site administrators.
Users are advised to update the HappyForms WordPress plugin to version 1.26.15 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 21, 2026CISA-ADP
Assessed Oct 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://wpscan.com/vulnerability/7673862c-b37c-4c7e-af3f-c32cbd2deb23/ | [email protected] | AdvisoryExploitRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-116 | Improper Encoding or Escaping of Output | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| HappyForms | < 1.26.15 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 21, 2026 | CVE Modified | CISA-ADP |
| Oct 21, 2026 | New CVE Received | [email protected] |