Happyforms

Products

Product	CVEs	Exploited	Latest
Happyforms	4	–	Sep 30, 2026
Happyforms Pro	2	–	Nov 7, 2026
Form builder to get in touch with visitors, grow your email list and collect payments — Happyforms	1	–	Nov 30, 2023
Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms	1	–	Jul 10, 2026

CVE-2026-93766 High 7.2 Happyforms Pro <= 1.38.9 - Unauthenticated Stored Cross-Site Scripting via 'happyforms_client_referer' Parameter –
CVE-2026-93755 High 7.2 Happyforms Pro <= 1.38.9 - Unauthenticated Stored Cross-Site Scripting via Client-IP/X-Forwarded-For Header –
CVE-2026-97065 High 7.1 WordPress Happyforms plugin <= 1.26.15 - Cross Site Scripting (XSS) vulnerability 0.2%
CVE-2025-11977 Medium 6.6 HappyForms <= 1.26.12 - Authenticated (Admin+) Local File Inclusion 0.9%
CVE-2026-49768 Critical 9.8 WordPress Happyforms plugin <= 1.26.13 - PHP Object Injection vulnerability 0.4%
CVE-2024-44063 Medium 6.5 WordPress Happyforms plugin <= 1.26.0 - Cross Site Scripting (XSS) vulnerability 0.3%
CVE-2024-23521 Medium 5.3 WordPress Happyforms plugin <= 1.25.10 - Broken Access Control vulnerability 0.4%
CVE-2023-48752 High 7.1 WordPress Happyforms Plugin <= 1.25.9 is vulnerable to Cross Site Scripting (XSS) 0.4%