What is the CVSS score of CVE-2025-63068?

CVE-2025-63068 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

PHP CVE-2025-63068

MEDIUM

Basic XSS (CWE-80)

2025-12-09 audit@patchstack.com

WordPress PHP XSS Code Injection

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 01, 2026 - 15:22 vuln.today

CVE Published

Dec 09, 2025 - 16:18 nvd

MEDIUM 5.3

DescriptionCVE.org

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in sevenspark Contact Form 7 - Dynamic Text Extension contact-form-7-dynamic-text-extension allows Code Injection.This issue affects Contact Form 7 - Dynamic Text Extension: from n/a through <= 5.0.5.

AnalysisAI

Improper HTML tag neutralization in sevenspark Contact Form 7 - Dynamic Text Extension through version 5.0.5 allows unauthenticated remote attackers to inject malicious scripts via a network-based attack with no user interaction required, resulting in confidentiality compromise through information disclosure. The vulnerability is classified as cross-site scripting (XSS) with low exploitability probability (EPSS 0.06%, percentile 18%), suggesting limited real-world attack incentive despite the network-accessible attack vector.

Technical ContextAI

The vulnerability stems from CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page), a foundational cross-site scripting flaw. The Contact Form 7 - Dynamic Text Extension plugin fails to properly sanitize or escape user-supplied input before rendering it in HTML context, allowing attackers to inject arbitrary script tags or event handlers. This affects the plugin's dynamic text rendering mechanism, which processes form field values without adequate XSS protections. The plugin is distributed via WordPress plugin repositories and is a community extension for the widely-used Contact Form 7 form builder.

Affected ProductsAI

sevenspark Contact Form 7 - Dynamic Text Extension versions from initial release through 5.0.5 are affected. The plugin is available on WordPress.org plugin repository and targets WordPress installations running Contact Form 7. Exact CPE mapping: vendors should reference the Patchstack advisory linked in references, which confirms version 5.0.3 vulnerability exposure; the advisory indicates the issue persists through at least 5.0.5.

RemediationAI

Update Contact Form 7 - Dynamic Text Extension to version 5.0.6 or later, which implements proper HTML tag neutralization and input sanitization. Website administrators should navigate to WordPress Dashboard > Plugins, locate Contact Form 7 - Dynamic Text Extension, and click Update if available. If automatic updates are not enabled, download the latest version from WordPress.org plugin repository and manually upload. As an interim mitigation pending update availability, restrict form submissions to trusted users via access controls or network segmentation if the affected form is not public-facing. Refer to the Patchstack vulnerability database entry (https://patchstack.com/database/Wordpress/Plugin/contact-form-7-dynamic-text-extension) for detailed patching guidance.