CVE-2025-63068
MEDIUMCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
2Tags
Description
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in sevenspark Contact Form 7 - Dynamic Text Extension contact-form-7-dynamic-text-extension allows Code Injection.This issue affects Contact Form 7 - Dynamic Text Extension: from n/a through <= 5.0.5.
Analysis
Improper HTML tag neutralization in sevenspark Contact Form 7 - Dynamic Text Extension through version 5.0.5 allows unauthenticated remote attackers to inject malicious scripts via a network-based attack with no user interaction required, resulting in confidentiality compromise through information disclosure. The vulnerability is classified as cross-site scripting (XSS) with low exploitability probability (EPSS 0.06%, percentile 18%), suggesting limited real-world attack incentive despite the network-accessible attack vector.
Technical Context
The vulnerability stems from CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page), a foundational cross-site scripting flaw. The Contact Form 7 - Dynamic Text Extension plugin fails to properly sanitize or escape user-supplied input before rendering it in HTML context, allowing attackers to inject arbitrary script tags or event handlers. This affects the plugin's dynamic text rendering mechanism, which processes form field values without adequate XSS protections. The plugin is distributed via WordPress plugin repositories and is a community extension for the widely-used Contact Form 7 form builder.
Affected Products
sevenspark Contact Form 7 - Dynamic Text Extension versions from initial release through 5.0.5 are affected. The plugin is available on WordPress.org plugin repository and targets WordPress installations running Contact Form 7. Exact CPE mapping: vendors should reference the Patchstack advisory linked in references, which confirms version 5.0.3 vulnerability exposure; the advisory indicates the issue persists through at least 5.0.5.
Remediation
Update Contact Form 7 - Dynamic Text Extension to version 5.0.6 or later, which implements proper HTML tag neutralization and input sanitization. Website administrators should navigate to WordPress Dashboard > Plugins, locate Contact Form 7 - Dynamic Text Extension, and click Update if available. If automatic updates are not enabled, download the latest version from WordPress.org plugin repository and manually upload. As an interim mitigation pending update availability, restrict form submissions to trusted users via access controls or network segmentation if the affected form is not public-facing. Refer to the Patchstack vulnerability database entry (https://patchstack.com/database/Wordpress/Plugin/contact-form-7-dynamic-text-extension) for detailed patching guidance.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today