CVE-2026-14556: CWE-116 Improper Encoding or Escaping of Output in HappyForms

The HappyForms WordPress plugin prior to version 1.26.15 does not properly sanitize or escape a user-controlled referral parameter before embedding it in notification emails. This improper output encoding (CWE-116) enables unauthenticated attackers to inject arbitrary HTML into emails received by site administrators. The vulnerability is identified as CVE-2026-14556 with a CVSS 3.1 base score of 5.4, indicating a medium severity risk. No known exploits are reported in the wild, and the plugin is not a cloud service.

An attacker can inject arbitrary HTML into notification emails sent to site administrators, potentially leading to phishing or social engineering attacks via manipulated email content. The confidentiality and integrity of the email content are impacted, but there is no direct impact on availability. The vulnerability requires no privileges and can be triggered remotely without user interaction.

A fix is available in HappyForms version 1.26.15 and later. Users should upgrade to version 1.26.15 or newer to remediate this vulnerability. Since the plugin is not a cloud service, manual update by site administrators is required. No additional mitigation steps are indicated by the vendor advisory.