What the vulnerability does
01Description
The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.0.5. This is due to insufficient output escaping on form shortcode keys displayed in the admin "Scan Forms for Post Meta and User Data Keys" page. This makes it possible for authenticated attackers, with Editor-level access and above, to inject arbitrary web scripts that execute when an Administrator runs the scan feature.
Explanation of Vulnerability in Simple Terms
02Summary
DTX – Dynamic Text Extension for Contact Form 7 versions up to 5.0.5 contain a cross-site scripting (XSS) vulnerability. An authenticated administrator with high privileges can inject malicious scripts that execute in other users' browsers, potentially affecting site visitors and other administrators. The vulnerability requires specific attack conditions and does not allow data theft or site disruption.
What an attacker can do
03Attacker Capabilities
Inject malicious scripts that run in other users' browsers when they view affected pages.
Potential impact on your site
04Site Impact
An admin account compromise could allow script injection affecting other admins and site visitors, but not data loss or availability.
Conditions required to exploit
05Prerequisites
Attacker must be an authenticated administrator or high-privilege user; no user interaction required from victims.
Key dates
06Disclosure timeline
August 5, 2026
CVE published
