plugin
12 known security issues reported for the Happyforms WordPress plugin. Most recent disclosed Jul 9, 2026.
Running Happyforms on your site? Check whether your installed version is affected.
Scan your site freeThe Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.26.12 via the happyforms_get_form_partial() function. This makes it possible for authenticated attackers, with...
The Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.26.13 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP...
[en] The Happyforms WordPress plugin before 1.26.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
The Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.26.2 due to insufficient input sanitization and output escaping. This makes it possi...
[en] Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Happyforms allows Stored XSS.This issue affects Happyforms: from n/a through 1.26.0.
The Happyforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.26.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will...
[en] Missing Authorization vulnerability in Happyforms.This issue affects Happyforms: from n/a through 1.25.10.
The Happyforms plugin for WordPress is vulnerable to unauthorized access due to a missing capability check in all versions up to, and including, 1.25.10. This makes it possible for unauthenticated attackers to perform unauthorized actions.
[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Happyforms Form builder to get in touch with visitors, grow your email list and collect payments — Happyforms allows Reflected XSS.This issue affects Form builder to get in touch with visitors, grow your email lis...
The Form builder to get in touch with visitors, grow your email list and collect payments — Happyforms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 1.25.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...
[en] The Happyforms WordPress plugin before 1.22.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
The Happyforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘className’ and 'anchor' block options in versions up to, and including, 1.21.1 due to insufficient input sanitization and output escaping. This makes it possible for contributor-level attackers to inject arbitrary web scripts in p...
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free