Stored Cross-Site Scripting Vulnerability in Happyforms Plugin for WordPress

CVE-2026-93755

What is CVE-2026-93755?

The Happyforms plugin for WordPress is susceptible to Stored Cross-Site Scripting due to flaws in how it handles client IP address headers. The plugin reads the raw HTTP_CLIENT_IP and HTTP_X_FORWARDED_FOR headers without proper validation or sanitization. This information is stored as post meta ('client_ip') during unauthenticated form submissions and subsequently displayed in the admin submission edit screen's details area without any output escaping. Attackers can exploit this vulnerability to inject malicious scripts, which can execute whenever administrators review the submissions, potentially compromising site integrity and data security.

References