The Happyforms Pro plugin for WordPress contains a stored cross‑site scripting flaw that allows unauthenticated attackers to inject arbitrary JavaScript into form pages by supplying malicious payloads through the 'happyforms_client_referer' parameter. The vulnerable data is stored in the database and rendered unescaped whenever the affected form page is viewed, causing the injected script to execute automatically in the browsers of any user who accesses that page. This flaw is identified as CWE‑79, representing a stored cross‑site scripting vulnerability.

All installations of Happyforms Pro version 1.38.9 or earlier that are enabled on a WordPress site are affected. The vulnerability is limited to the WordPress plugin and does not depend on any particular operating system or sub‑component beyond the plugin itself.

The CVSS score of 7.2 indicates a high severity. Because the vulnerable parameter can be accessed without authentication, an attacker can submit malicious payloads from any client. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, but the lack of mitigation in current releases means the flaw is readily exploitable as soon as an unfiltered 'happyforms_client_referer' value is stored. A single injected script will run automatically for any user who visits the affected form page.