EUVD-2026-53176
GHSA-h3v3-jhc3-m8w7
Severity by source
AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
Editor credentials required (PR:H); administrator must actively run the scan to trigger payload (UI:R, correcting provided UI:N); injected script executes in admin browser scope (S:C); limited session/data exposure only.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Contact Form 7 - Dynamic Text Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.0.5. This is due to insufficient output escaping on form shortcode keys displayed in the admin "Scan Forms for Post Meta and User Data Keys" page. This makes it possible for authenticated attackers, with Editor-level access and above, to inject arbitrary web scripts that execute when an Administrator runs the scan feature.
AnalysisAI
Stored XSS in the Contact Form 7 Dynamic Text Extension WordPress plugin (all versions through 5.0.5) enables an authenticated Editor-level user to inject arbitrary JavaScript into form shortcode keys, which executes in an administrator's browser when the admin triggers the 'Scan Forms for Post Meta and User Data Keys' feature. The Scope:Changed CVSS metric correctly reflects that the injected payload runs in a higher-privilege context (administrator session) than where it was planted (editor account). No public exploit code and no CISA KEV listing exist at time of analysis; vendor-released patch version 5.0.6 resolves the issue.
Technical ContextAI
The vulnerability resides in the WordPress plugin Contact Form 7 - Dynamic Text Extension (CPE: cpe:2.3:a:sevenspark:dtx_-_dynamic_text_extension_for_contact_form_7:*:*:*:*:*:*:*:*) by SevenSpark, which extends the widely-used Contact Form 7 plugin with dynamic shortcode-driven text fields populated from WordPress post meta and user data. The vulnerable code path is in includes/admin/settings.php at approximately lines 544 and 559 (confirmed from plugin Trac browser references for tag 5.0.4), where form shortcode keys are retrieved and rendered on the admin scan page without adequate HTML output escaping. This is a classic CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting) root cause: attacker-controlled input stored in the database is later echoed into an HTML context without sanitization, allowing injection of executable script content.
RemediationAI
Upgrade to version 5.0.6 immediately; this release is confirmed by the WordPress plugin repository changeset between tags 5.0.5 and 5.0.6 at https://plugins.trac.wordpress.org/changeset?new=3561908%40contact-form-7-dynamic-text-extension%2Ftags%2F5.0.6&old=3463604%40contact-form-7-dynamic-text-extension%2Ftags%2F5.0.5. Updates can be applied via the WordPress dashboard (Plugins → Updates) or via WP-CLI with wp plugin update contact-form-7-dynamic-text-extension. If immediate upgrade is not feasible, restrict Editor-level user accounts from creating or editing form shortcode keys to eliminate the injection surface, accepting the trade-off of reduced editorial functionality. Alternatively, instruct administrators to avoid running the 'Scan Forms for Post Meta and User Data Keys' feature until the patch is applied, which prevents payload execution without requiring role changes. Deploying a Content-Security-Policy header for the wp-admin path that blocks inline script execution (script-src 'self') provides an additional layer of XSS mitigation across the entire admin panel, though this may break other plugins relying on inline scripts.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today