Contact Form 7 – Dynamic Text Extension
Contact Form 7 – Dynamic Text Extension adds dynamic text fields to Contact Form 7 forms using generated or contextual values.
Contact Form 7 – Dynamic Text Extension (contact-form-7-dynamic-text-extension) is a WordPress plugin with 5 published CVE records in this archive. The latest tracked vulnerability was published Aug 05, 2026; the highest published CVSS base score is 6.5.
contact-form-7-dynamic-text-extensionCVE-2026-5116: DTX shortcode keys execute stored XSS during an administrator scan
DTX through 5.0.5 lets an Editor store a malicious Contact Form 7 shortcode key. The Scan Forms for Post Meta and User Data Keys administration page later displays stored shortcode keys without sufficient output escaping, so the payload executes in the WordPress origin when an Administrator runs the scan. This 4.4-scored record received deeper review because the stored-XSS path is specifically likely to reach an administrator. The CNA does not disclose the form field, scan route or rendering function.
| Safe version |
|
||
|---|---|---|---|
| Aug 05, 2026 |
CVE-2026-5116
DTX shortcode keys execute stored XSS during an administrator scan
DTX through 5.0.5 lets an Editor store a malicious Contact Form 7 shortcode key. The Scan Forms for Post Meta and User Data Keys administration page later displays stored shortcode keys without sufficient output escaping, so the payload executes in the WordPress origin when an Administrator runs the scan. This 4.4-scored record received deeper review because the stored-XSS path is specifically likely to reach an administrator. The CNA does not disclose the form field, scan route or rendering function.
|
5.0.6 |
CVE4.4
NVDPending
|
| Jul 22, 2026 |
CVE-2025-13146
Dynamic Text Extension permits unauthenticated shortcode execution
Contact Form 7 - Dynamic Text Extension through 5.0.6 can pass an attacker-controlled value to do_shortcode without sufficient validation. An unauthenticated attacker can invoke shortcodes exposed by the site; the resulting impact depends on which plugins and shortcodes are installed. Version 5.0.4 only partially addressed the weakness.
|
See mitigation notes |
CVE6.5
NVDPending
|
| Dec 09, 2025 |
CVE-2025-63068
Contact Form 7 – Dynamic Text Extension: Cross-site scripting
Contact Form 7 – Dynamic Text Extension is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.
|
See mitigation notes |
CVE5.3
NVDPending
|
| Dec 31, 2024 |
CVE-2024-56218
Contact Form 7 – Dynamic Text Extension: Cross-site request forgery
Contact Form 7 – Dynamic Text Extension is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.
|
See mitigation notes |
CVE4.3
NVDPending
|
| Nov 05, 2024 |
CVE-2024-10084
Contact Form 7 – Dynamic Text Extension: Sensitive information exposure
Contact Form 7 – Dynamic Text Extension is affected by sensitive information exposure. Exploitation requires an authenticated contributor account. Successful exploitation can disclose data that should not be available to the caller. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.
|
See mitigation notes |
CVE4.3
NVDPending
|