Happyforms vulnerabilities

3 known CVE vulnerabilities in Happyforms, translated and rated.

CVE-2026-97065High
Unauthenticated XSS attack in Happyforms plugin up to version 1.26.15. An attacker can inject malicious script without authentication.
CVE-2026-49768Critical
Happyforms versions up to 1.26.13 are vulnerable to unauthenticated PHP object injection.
CVE-2025-11977Medium
The Happyforms plugin for WordPress up to version 1.26.12 is vulnerable to Local File Inclusion (LFI) via the happyforms_get_form_partial() function. This allows authenticated attackers with Administrator-level access or higher to include and execute arbitrary .php files on the server.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS