CVE-2026-14556: HappyForms < 1.26.15 - Unauthenticated HTML Injection in Admin Notification Email via client_referer
The HappyForms WordPress plugin before 1.26.15 does not sanitise or escape a user-controlled referral value before embedding it in the form notification email, allowing unauthenticated attackers to inject arbitrary HTML into the emails site administrators receive.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites running a HappyForms version earlier than 1.26.15 are affected. The injected content is delivered in form notification emails received by site administrators.
Does exploitation require an account or administrator interaction?
An attacker does not need authentication and can supply a controlled referral value. Exploitation requires an administrator to receive and view the resulting notification email.
What should be done to remediate the issue?
Update HappyForms to version 1.26.15 or later. The provided data does not identify an alternative mitigation if updating is not immediately possible.