CVE-2026-14556

Published: Oct 21, 2026Modified: Oct 21, 2026Deferred

5.4

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.5

Source: contact@wpscan.com (Secondary)

Description

The HappyForms WordPress plugin before 1.26.15 does not sanitise or escape a user-controlled referral value before embedding it in the form notification email, allowing unauthenticated attackers to inject arbitrary HTML into the emails site administrators receive.

Related CWEs

CWE-116

Improper Encoding or Escaping of Output

The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

References (1)

https://wpscan.com/vulnerability/7673862c-b37c-4c7e-af3f-c32cbd2deb23/

Source: contact@wpscan.com

Timeline

No history available yet.