Medium severity5.4NVD Advisory· Published Oct 21, 2026

CVE-2026-14556

Description

The HappyForms WordPress plugin before 1.26.15 does not sanitise or escape a user-controlled referral value before embedding it in the form notification email, allowing unauthenticated attackers to inject arbitrary HTML into the emails site administrators receive.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Happyformsllm-fuzzy
Range: <1.26.15
Package: https://wordpress.org/plugins/happyforms

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/7673862c-b37c-4c7e-af3f-c32cbd2deb23/nvd

News mentions

No linked articles in our index yet.

cvss	0.351
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000