Dtx Dynamic Text Extension For Contact Form 7
Monthly
Stored XSS in the Contact Form 7 Dynamic Text Extension WordPress plugin (all versions through 5.0.5) enables an authenticated Editor-level user to inject arbitrary JavaScript into form shortcode keys, which executes in an administrator's browser when the admin triggers the 'Scan Forms for Post Meta and User Data Keys' feature. The Scope:Changed CVSS metric correctly reflects that the injected payload runs in a higher-privilege context (administrator session) than where it was planted (editor account). No public exploit code and no CISA KEV listing exist at time of analysis; vendor-released patch version 5.0.6 resolves the issue.
Stored XSS in the Contact Form 7 Dynamic Text Extension WordPress plugin (all versions through 5.0.5) enables an authenticated Editor-level user to inject arbitrary JavaScript into form shortcode keys, which executes in an administrator's browser when the admin triggers the 'Scan Forms for Post Meta and User Data Keys' feature. The Scope:Changed CVSS metric correctly reflects that the injected payload runs in a higher-privilege context (administrator session) than where it was planted (editor account). No public exploit code and no CISA KEV listing exist at time of analysis; vendor-released patch version 5.0.6 resolves the issue.