CVE-2026-14556

An HTML Injection vulnerability exists in the WordPress HappyForms plugin in versions prior to 1.26.15. The plugin does not sanitise or escape a user-controlled referral value before embedding it in the form notification email.

An unauthenticated attacker can inject arbitrary HTML into the emails site administrators receive, by submitting a form with a crafted referral value.

The referral value supplied with a form submission is embedded into the notification email without sanitization or output escaping, so attacker-controlled HTML passes through unchanged.

Attack vector: Unauthenticated form submission with a crafted referral value, delivered to administrators via the notification email.

• Arbitrary HTML injected into administrator notification emails
• Phishing and social-engineering content delivered to site administrators
• Confidentiality and integrity impact on email content

Update HappyForms to version 1.26.15 or later.