Live › vulnerability › CVE-2026-14556
Go to dashboardThe HappyForms WordPress plugin before 1.26.15 places a user-supplied referral value into form notification emails without sanitising or escaping it. An unauthenticated attacker can inject arbitrary HTML into the emails that site administrators receive.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the HappyForms plugin before 1.26.15 that send form notification emails containing the referral value are exposed. Sites without HappyForms, or running or later, are not affected.
1.26.15No product ranges from the sources yet.
wp plugin get happyforms --field=version, and compare it against 1.26.15.wp-content/plugins/ on the server.1.26.15 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The HappyForms WordPress plugin before 1.26.15 does not sanitise or escape a user-controlled referral value before embedding it in the form notification email, allowing unauthenticated attackers to inject arbitrary HTML into the emails site administrators receive.
This page as .md · .json · in your agent: get_signal("CVE-2026-14556")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.