CVE-2026-14556

Deferred Deferred - Pending Action

HTML Injection in HappyForms WordPress Plugin

Publication date: 2026-10-21

Last updated on: 2026-10-21

Assigner: WPScan

Description

The HappyForms WordPress plugin before 1.26.15 does not sanitise or escape a user-controlled referral value before embedding it in the form notification email, allowing unauthenticated attackers to inject arbitrary HTML into the emails site administrators receive.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-21

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-09

NVD

CVE-2026-14556

EUVD

EUVD-2026-107147

Affected Vendors & Products

Vendor	Product	Version / Range
Unknown	HappyForms	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-116	The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

Attack-Flow Graph

Executive Summary

The HappyForms WordPress plugin before version 1.26.15 has a vulnerability where it does not properly sanitize or escape a user-controlled referral value before including it in form notification emails sent to site administrators. This allows unauthenticated attackers to inject arbitrary HTML code into these emails.

Detection Guidance

Check the installed version of the HappyForms WordPress plugin. If it is below 1.26.15, the system is vulnerable. Inspect email headers or content for unexpected HTML or script tags in admin notifications.

Impact Analysis

This vulnerability could allow attackers to inject malicious HTML into emails received by site administrators. This might lead to phishing attacks, defacement of email content, or delivery of malware through crafted links or scripts in the injected HTML.

Compliance Impact

This vulnerability could potentially affect compliance with GDPR and HIPAA by enabling attackers to inject malicious HTML into admin emails. This may lead to phishing attacks or unauthorized data exposure if sensitive information is included in notifications. The lack of input sanitization increases the risk of email-based attacks that could compromise user data or violate privacy regulations.

Mitigation Strategies

Update the HappyForms plugin to version 1.26.15 or later immediately. If updating is not possible, consider disabling the plugin until a patch is applied.

Hi! I’m here to help you understand CVE-2026-14556. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...