Is CVE-2026-14556 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-14556 being exploited in the wild.

How severe is CVE-2026-14556?

Medium severity, with a CVSS score of 5.4, published 21 October 2026.

Is there a fix for CVE-2026-14556?

Yes: fixed in 1.26.15. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-14556 attacked?

It is attacked over the network.

Am I affected by CVE-2026-14556?

Check whether you run Happyforms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-14556: HappyForms WordPress plugin HTML injection in notification email

CVE-2026-14556 · Severity: medium · CVSS 5.4 · Published 2026-10-21

HappyForms is a WordPress plugin that creates web forms and emails notifications to site administrators when forms are submitted. The plugin fails to properly sanitize user input from a referral field before embedding it in notification emails, allowing attackers to inject malicious HTML code into emails that administrators receive. This could be used for phishing attacks, credential theft, or social engineering against site administrators.

Technologies: Happyforms. Vendors: Happyforms.

Quick answers

Is CVE-2026-14556 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-14556 being exploited in the wild.
How severe is CVE-2026-14556?: Medium severity, with a CVSS score of 5.4, published 21 October 2026.
Which products and versions are affected?: Happyforms before 1.26.15.
Is there a fix for CVE-2026-14556?: Yes: fixed in 1.26.15. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-14556 attacked?: It is attacked over the network.
Am I affected by CVE-2026-14556?: Check whether you run Happyforms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.26.15

Technical details

The vulnerability is an unauthenticated HTML injection in the admin notification email functionality. An attacker can supply a crafted referral value via the client_referer parameter that is not sanitized or escaped before being embedded in the form notification email. No authentication is required; any unauthenticated user can submit a form with a malicious referral value to inject arbitrary HTML into emails sent to administrators.

Affected products

happyforms HappyForms before 1.26.15

Timeline

2026-10-19: disclosed
2026-10-21: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.