CVE WATCH / VULNERABILITY DETAIL
CVE-2026-93755
HIGHCVSS 7.2NVD feed
Published 7 November 2026 · tracked since 8 November 2026
Description
The Happyforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via spoofable client IP headers in versions up to, and including, 1.38.9. This is due to the happyforms_get_client_ip() function reading raw HTTP_CLIENT_IP and HTTP_X_FORWARDED_FOR request headers without any validation
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-124318 HIGH 7.2
- CVE-2026-122041 CRITICAL 9.1
- CVE-2026-120841 HIGH 8.8
- CVE-2026-120839 HIGH 8.8
- CVE-2026-119156 HIGH 7.2
- CVE-2026-93766 HIGH 7.2
- CVE-2026-93429 HIGH 7.2
- CVE-2026-123418 HIGH 7.2
- CVE-2026-122231 HIGH 7.2
- CVE-2026-119183 HIGH 7.2