CVE-2026-97065
HighCVSS 7.1Summary
Unauthenticated XSS attack in Happyforms plugin up to version 1.26.15. An attacker can inject malicious script without authentication.
Risk Assessment
Risk of session hijacking, admin account takeover, or malware distribution on the site.
Recommendation
Update the Happyforms plugin to the latest available version with the security fix.
Other vulnerabilities in Happyforms
See all- CVE-2026-49768Critical
Happyforms versions up to 1.26.13 are vulnerable to unauthenticated PHP object injection.
- CVE-2025-11977Medium
The Happyforms plugin for WordPress up to version 1.26.12 is vulnerable to Local File Inclusion (LFI) via the happyforms_get_form_partial() function. This allows authenticated attackers with Administrator-level access or higher to include and execute arbitrary .php files on the server.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in Happyforms <= 1.26.15 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS