CVE-2026-14556 — HappyForms < 1.26.15 - Unauthenticated HTML Injection in Admin Notification Email via client_referer

CVE-2026-14556

HappyForms < 1.26.15 - Unauthenticated HTML Injection in Admin Notification Email via client_referer PUBLISHED

Description (CNA)

The HappyForms WordPress plugin before 1.26.15 does not sanitise or escape a user-controlled referral value before embedding it in the form notification email, allowing unauthenticated attackers to inject arbitrary HTML into the emails site administrators receive.

Affected (CNA)

Vendor / product	Versions
Unknown / HappyForms	affected 0 before 1.26.15

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/7673862c-b37c-4c7e-af3f-c32cbd2deb23/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.