CVE-2026-97065: WordPress Happyforms plugin <= 1.26.15 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Happyforms <= 1.26.15 versions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Happyforms pluginto a version that resolves this vulnerability.Fixed in 1.26.16
Event History
Frequently Asked Questions
Who can exploit this issue?
The vulnerability is unauthenticated, so an attacker does not need a Happyforms account or WordPress login. Exploitation still requires user interaction, as indicated by the UI:R attack vector.
Which installations are affected?
Happyforms plugin versions 1.26.15 and earlier are affected according to the available data. The provided information does not state whether any particular Happyforms configuration or feature must be enabled.
What impact can successful exploitation have?
Successful cross-site scripting can affect confidentiality, integrity, and availability at low impact levels. The scope is changed, meaning the impact may extend beyond the vulnerable component's original security authority.