CVE WATCH / VULNERABILITY DETAIL
CVE-2026-93766
HIGHCVSS 7.2NVD feed
Published 7 November 2026 · tracked since 8 November 2026
Description
The Happyforms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'happyforms_client_referer' parameter in all versions up to, and including, 1.38.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject a
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-124318 HIGH 7.2
- CVE-2026-122041 CRITICAL 9.1
- CVE-2026-120841 HIGH 8.8
- CVE-2026-120839 HIGH 8.8
- CVE-2026-119156 HIGH 7.2
- CVE-2026-93755 HIGH 7.2
- CVE-2026-93429 HIGH 7.2
- CVE-2026-123418 HIGH 7.2
- CVE-2026-122231 HIGH 7.2
- CVE-2026-119183 HIGH 7.2