What is the CVSS score of EUVD-2026-53176?

EUVD-2026-53176 has a CVSS 3.1 base score of 4.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Dynamic Text Extension EUVD-2026-53176

| CVE-2026-5116 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-08-05 Wordfence

GHSA-h3v3-jhc3-m8w7

WordPress XSS Wordpress Plugin Dtx Dynamic Text Extension For Contact Form 7 Sevenspark

4.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.4 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

4.0 MEDIUM

Editor credentials required (PR:H); administrator must actively run the scan to trigger payload (UI:R, correcting provided UI:N); injected script executes in admin browser scope (S:C); limited session/data exposure only.

3.1 AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 08:03 vuln.today

CVE Published

Aug 05, 2026 - 06:37 cve.org

MEDIUM 4.4

DescriptionCVE.org

The Contact Form 7 - Dynamic Text Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.0.5. This is due to insufficient output escaping on form shortcode keys displayed in the admin "Scan Forms for Post Meta and User Data Keys" page. This makes it possible for authenticated attackers, with Editor-level access and above, to inject arbitrary web scripts that execute when an Administrator runs the scan feature.

AnalysisAI

Stored XSS in the Contact Form 7 Dynamic Text Extension WordPress plugin (all versions through 5.0.5) enables an authenticated Editor-level user to inject arbitrary JavaScript into form shortcode keys, which executes in an administrator's browser when the admin triggers the 'Scan Forms for Post Meta and User Data Keys' feature. The Scope:Changed CVSS metric correctly reflects that the injected payload runs in a higher-privilege context (administrator session) than where it was planted (editor account). No public exploit code and no CISA KEV listing exist at time of analysis; vendor-released patch version 5.0.6 resolves the issue.

Technical ContextAI

The vulnerability resides in the WordPress plugin Contact Form 7 - Dynamic Text Extension (CPE: cpe:2.3:a:sevenspark:dtx_-_dynamic_text_extension_for_contact_form_7:*:*:*:*:*:*:*:*) by SevenSpark, which extends the widely-used Contact Form 7 plugin with dynamic shortcode-driven text fields populated from WordPress post meta and user data. The vulnerable code path is in includes/admin/settings.php at approximately lines 544 and 559 (confirmed from plugin Trac browser references for tag 5.0.4), where form shortcode keys are retrieved and rendered on the admin scan page without adequate HTML output escaping. This is a classic CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting) root cause: attacker-controlled input stored in the database is later echoed into an HTML context without sanitization, allowing injection of executable script content.

RemediationAI

Upgrade to version 5.0.6 immediately; this release is confirmed by the WordPress plugin repository changeset between tags 5.0.5 and 5.0.6 at https://plugins.trac.wordpress.org/changeset?new=3561908%40contact-form-7-dynamic-text-extension%2Ftags%2F5.0.6&old=3463604%40contact-form-7-dynamic-text-extension%2Ftags%2F5.0.5. Updates can be applied via the WordPress dashboard (Plugins → Updates) or via WP-CLI with wp plugin update contact-form-7-dynamic-text-extension. If immediate upgrade is not feasible, restrict Editor-level user accounts from creating or editing form shortcode keys to eliminate the injection surface, accepting the trade-off of reduced editorial functionality. Alternatively, instruct administrators to avoid running the 'Scan Forms for Post Meta and User Data Keys' feature until the patch is applied, which prevents payload execution without requiring role changes. Deploying a Content-Security-Policy header for the wp-admin path that blocks inline script execution (script-src 'self') provides an additional layer of XSS mitigation across the entire admin panel, though this may break other plugins relying on inline scripts.