Known vulnerabilities in Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms

Best WordPress contact form, newsletter form and payment form builder without the sucky stuff — lost emails, pesky spam, leaky privacy and outsourced …

7Reported vulnerabilities

8.1Highest CVSS score

1.26.15Latest version

20,000+Active installs

What to do now

Update Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms to 1.26.13 or later. 7 of these have a fixed version available. Updating resolves them.

Plugin last updated: July 14, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVE	Severity	Exploit probability next 30 days	Affected versions	Fixed in	Published
CVE-2023-0096	Medium 5.4	0.5%	Before 1.22.0	`1.22.0`	February 6, 2023
CVE-2024-10054	Medium 4.8	0.3%	Before 1.26.3	`1.26.3`	May 15, 2025
CVE-2026-49768	High 8.1	0.4%	1.26.13 and earlier	`1.26.14`	June 4, 2026
CVE-2025-11977	Medium 6.6	0.9%	1.26.12 and earlier	`1.26.13`	July 9, 2026
CVE-2024-44063	Medium 6.4	0.3%	1.26.0 and earlier	`1.26.1`	August 29, 2024
CVE-2023-48752	Medium 6.1	0.4%	1.25.9 and earlier	`1.25.10`	November 27, 2023
CVE-2024-23521	Medium 5.3	0.4%	1.25.10 and earlier	`1.25.11`	January 31, 2024

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.