GCVE - cpe:2.3:a:happyforms:happyforms:*:*:*:*:*:wordpress:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:happyforms:happyforms:*:*:*:*:*:wordpress:*:*

part: a version: * update: *

Vendor	Happyforms (`c4b0fde8-bdfb-5852-8c17-e679e3cf859d`)
Product	Happyforms (`839860ba-83f0-509a-9d39-fc34a071b963`)
Edition	*
Language	*
Software edition	*
Target software	wordpress
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/mozilla/happyforms`	purl2cpe	2026-06-01 10:16:06.938537

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2024-44063`	vulnerable	2026-06-08 06:45:53.529921	WordPress Happyforms plugin <= 1.26.0 - Cross Site Scripting (XSS) vulnerability MEDIUM (6.5) Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Happyforms allows Stored XSS.This issue affects Happyforms: from n/a through 1.26.0. Published: 2024-09-15T07:54:07.630Z Updated: 2026-04-28T16:10:17.321Z Open on db.gcve.eu Reference links https://patchstack.com/database/vulnerability/happyforms/wordpress-happyforms-plugin-1-26-0-cross-site-scripting-xss-vulnerability?_s_id=cve	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-23521`	vulnerable	2026-06-08 06:29:39.874159	WordPress Happyforms plugin <= 1.25.10 - Broken Access Control vulnerability MEDIUM (5.3) Missing Authorization vulnerability in Happyforms.This issue affects Happyforms: from n/a through 1.25.10. Published: 2024-06-11T15:34:46.214Z Updated: 2026-04-28T16:09:10.090Z Open on db.gcve.eu Reference links https://patchstack.com/database/vulnerability/happyforms/wordpress-happyforms-plugin-1-25-10-broken-access-control-vulnerability?_s_id=cve	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-10054`	vulnerable	2026-06-08 06:22:03.494442	Happyforms < 1.26.3 - Admin+ Stored XSS The Happyforms WordPress plugin before 1.26.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Published: 2025-05-15T20:06:39.956Z Updated: 2025-05-20T16:04:01.640Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/5a9fd64b-3207-4acb-92ff-1cca08c41ac9/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-48752`	vulnerable	2026-06-08 06:14:28.001053	WordPress Happyforms Plugin <= 1.25.9 is vulnerable to Cross Site Scripting (XSS) HIGH (7.1) Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Happyforms Form builder to get in touch with visitors, grow your email list and collect payments — Happyforms allows Reflected XSS.This issue affects Form builder to get in touch with visitors, grow your email list and collect payments — Happyforms: from n/a through 1.25.9. Published: 2023-11-30T16:19:42.943Z Updated: 2026-04-28T16:08:54.845Z Open on db.gcve.eu Reference links https://patchstack.com/database/vulnerability/happyforms/wordpress-happyforms-plugin-1-25-9-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-0096`	vulnerable	2026-06-08 05:52:04.275045	Happyforms < 1.22.0 - Contributor+ Stored XSS The Happyforms WordPress plugin before 1.22.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Published: 2023-02-06T19:59:39.682Z Updated: 2025-03-25T18:05:04.183Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/b28150e7-214b-4bcd-85c0-e819c4223484	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.