HappyForms CVE-2026-14556

Exploitation requires that the target site runs HappyForms before 1.26.15 with at least one publicly reachable form that generates admin notification emails (the plugin's default email-notification feature), and that the referral value is passed through to that email unescaped. The decisive limiting factor is user interaction (UI:R): the injected HTML only takes effect when a site administrator actually opens and views the notification email, so there is no automatic server-side compromise. No attacker authentication is needed (PR:N), and no special non-default plugin configuration is indicated by the description beyond the standard notification-email functionality being enabled.

This is a genuine but moderate-severity issue, not a top-tier emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N, base 5.4) shows a network-reachable, low-complexity flaw requiring no attacker privileges - consistent with the description's 'unauthenticated attackers' claim. The key risk-limiting signal is UI:R: exploitation is not self-contained because a site administrator must open and view the attacker-influenced notification email for the injected HTML to render. A public exploit exists (reported by WPScan), which raises the practical likelihood of opportunistic abuse, but POC availability is NOT the same as active exploitation. No EPSS score was provided, so exploitation probability cannot be quantified. The CVE is NOT listed in CISA KEV and there is no SSVC decision data in the input, so there is no evidence of confirmed in-the-wild exploitation. The realistic impact is bounded: HTML injection into admin-facing emails enables phishing, content spoofing, and social-engineering of administrators rather than direct code execution or data theft, which matches the Low confidentiality/integrity and None availability sub-scores. Overall: treat as a standard-priority patching item for affected HappyForms installs, elevated slightly by public POC and no-authentication reachability, but not a drop-everything critical.

An unauthenticated attacker submits a HappyForms form while supplying a crafted referral value containing malicious HTML (e.g., a fake login link or spoofed support notice). Because the referral value is embedded unescaped into the form-notification email, the injected markup renders when a site administrator opens that email, enabling phishing or content spoofing. A public exploit for this technique is already available via WPScan, and the low attack complexity (AC:L) means crafting the request is trivial.