Description
The HappyForms WordPress plugin before 1.26.15 does not sanitise or escape a user-controlled referral value before embedding it in the form notification email, allowing unauthenticated attackers to inject arbitrary HTML into the emails site administrators receive.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | HappyForms | < 1.26.15 | 1.26.15 |
References
- https://wpscan.com/vulnerability/7673862c-b37c-4c7e-af3f-c32cbd2deb23/ exploit vdb-entry technical-description