HappyForms vulnerabilities
We track 2 vulnerabilities in HappyForms products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on November 7, 2026.
2vulnerabilities
0critical
2high
0exploited
7.2average CVSS score
Latest HappyForms vulnerabilities
- 7.2 High severity
Happyforms Pro: Improper Neutralization of Input During Web Page Generation
The Happyforms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'happyforms_client_referer' parameter in all versions up to, and including, 1.38.9 due to insufficient input sanitization and output escaping. This makes it possible f
- 7.2 High severity
Happyforms Pro: Improper Neutralization of Input During Web Page Generation
The Happyforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via spoofable client IP headers in versions up to, and including, 1.38.9. This is due to the happyforms_get_client_ip() function reading raw HTTP_CLIENT_IP and HTTP_X_FORWARDED_FO