Happyforms Pro vulnerabilities

2 known vulnerabilities in Happyforms Pro from HappyForms. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.2 High severity

  Happyforms Pro: Improper Neutralization of Input During Web Page Generation

  CVE-2026-93766Nov 7, 2026HappyForms

  The Happyforms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'happyforms_client_referer' parameter in all versions up to, and including, 1.38.9 due to insufficient input sanitization and output escaping. This makes it possible f

• 7.2 High severity

  Happyforms Pro: Improper Neutralization of Input During Web Page Generation

  CVE-2026-93755Nov 7, 2026HappyForms

  The Happyforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via spoofable client IP headers in versions up to, and including, 1.38.9. This is due to the happyforms_get_client_ip() function reading raw HTTP_CLIENT_IP and HTTP_X_FORWARDED_FO