In versions of the HappyForms WordPress plugin prior to 1.26.15, the client_referer value is inserted into the content of the form notification email without sanitisation or escaping. This flaw is a classic example of the CWE-116 weakness—uncontrolled format string that allows an attacker to inject arbitrary HTML. The injected content arrives in the notification emails that site administrators receive, potentially enabling phishing attempts, silently loading malicious scripts, or manipulating page layout when the email is viewed in a web client.

The vulnerable component is the HappyForms plugin for WordPress. Any site running HappyForms before version 1.26.15 is affected, regardless of the WordPress core or theme version, because the flaw resides entirely within the plugin’s notification handling code.

The CVSS base score of 5.4 indicates a moderate severity, primarily due to the lack of authentication requirement but limited to HTML context. The EPSS score of less than 1 percent suggests a low likelihood of active exploitation at present, and the vulnerability is not currently listed in the CISA KEV catalog. Exploitation requires the attacker to craft a malicious client_referer header and trigger a form submission so that the reference is included in the notification. Once the email is opened by an administrator, the injected HTML can divert the user or execute scripts in the mail client or web-based email viewer.