The Happyforms Pro WordPress plugin contains a stored XSS flaw that arises from the client IP extraction function reading raw HTTP_CLIENT_IP and HTTP_X_FORWARDED_FOR headers without validation. The extracted value is saved as post meta and later displayed in the admin submission details, enabling an attacker to embed JavaScript into the page seen by users with editorial access. An injected script runs whenever an administrator or other privileged user views a submission, potentially compromising credentials, defacing the site, or hijacking sessions.

This vulnerability affects Happyforms Pro versions up to 1.38.9 and all earlier releases that may be present in WordPress installations. Administrators using those plugins are at risk if their site receives form submissions from unauthenticated users.

The CVSS score of 7.2 indicates a moderate to high severity. The exploit requires only that an unauthenticated request include a forged X‑Forwarded‑For header; no authentication or privileged access is needed. EPSS data is unavailable, and the vulnerability is not currently listed in CISA’s KEV catalog, suggesting limited public exploitation but the attack path is straightforward. The vulnerability can be triggered by any entity that can submit a form to the site, meaning a broad attack surface.