Read the docs
TI-2026-78540 Aliases CVE-2026-14556GHSA-qwq5-hm76-r6p9

Unauthenticated HTML injection in HappyForms admin notification email

Priority LOW 24CWE-116Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

The HappyForms WordPress plugin before 1.26.15 does not sanitise or escape a user-controlled referral value before embedding it in the form notification email. An unauthenticated remote attacker can inject arbitrary HTML into the notification emails that site administrators receive. The weakness is classified under CWE-116. The references link to an exploit.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

The HappyForms WordPress plugin before 1.26.15 does not sanitise or escape a user-controlled referral value before embedding it in the form notification email, allowing unauthenticated attackers to inject arbitrary HTML into the emails site administrators receive.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00202 10th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed HappyForms (Unknown): 1.26.15

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownHappyFormsbefore 1.26.151.26.15Patch availableCNA
  • HappyForms VendorUnknown Affected before 1.26.15 Fixed in 1.26.15 Patch available CNA

Remediation

Update HappyForms to version 1.26.15 or later.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA HappyForms (Unknown) Fixed in 1.26.15

Timeline

  1. 2026-10-21 Threatist record created from CVE-2026-14556
  2. 2026-10-21 Alias added: GHSA-qwq5-hm76-r6p9

References

Exploit 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences