Contact Form 7 – Dynamic Text Extension Stored XSS Vulnerability (CVE-2026-5116)

Vulnerability Overview Vulnerability Name: Contact Form 7 – Dynamic Text Extension <= 5.0.5 - Authenticated (Editor+) Stored Cross-Site Scripting CVE ID: CVE-2026-5116 CVSS Score: 4.4 (Medium) Publication Date: August 4, 2026 Last Update Date: August 5, 2026 Researcher: SATYARTH PRAKASH (XxoxL33n) Scope of Impact Software Type: Plugin Software Name: Contact Form 7 – Dynamic Text Extension Affected Versions: <= 5.0.5 Fixed Version: 5.0.6 Remediation Recommendation: Upgrade to version 5.0.6 or higher. Vulnerability Description The Contact Form 7 – Dynamic Text Extension plugin suffers from a Stored Cross-Site Scripting (XSS) vulnerability across all WordPress versions, including 5.0.5. This issue arises due to insufficient output encoding of form shortcode keys on the administrator's "Scan Form" page. This allows authenticated attackers with editor-level privileges or higher to inject arbitrary web scripts, which are executed when the administrator runs the scan functionality. References plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org Additional Information CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N Related Recent Vulnerabilities 1. Contact Form 7 – Dynamic Text Extension <= 5.0.6 - Unauthenticated Arbitrary Shortcode Execution - CVE ID: CVE-2025-13146 - CVSS Score: 6.5 - Researcher: NooNeeP++ - Date: July 21, 2026 2. Contact Form 7 – Dynamic Text Extension <= 5.0.5 - Unauthenticated Arbitrary Shortcode Execution - CVE ID: CVE-2025-63068 - CVSS Score: 6.5 - Researcher: Najib Sirjani - Date: September 26, 2025 3. Contact Form 7 Dynamic Text Extension <= 5.0.1 - Cross-Site Request Forgery - CVE ID: CVE-2024-56218 - CVSS Score: 4.3 - Researcher: Francesco Carlucci - Date: December 19, 2024 4. Contact Form 7 – Dynamic Text Extension <= 4.5 - Information Disclosure via Shortcode - CVE ID: CVE-2024-10084 - CVSS Score: 4.3 - Researcher: Francesco Carlucci - Date: November 5, 2024 5. Contact Form 7 – Dynamic Text Extension <= 4.1.0 - Insecure Direct Object Reference - CVE ID: CVE-2023-6630 - CVSS Score: 4.3 - Researcher: Francesco Carlucci - Date: January 10, 2024 6. Contact Form 7 Dynamic Text Extension <= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode - CVE ID: Not provided - CVSS Score: 6.4 - Researcher: Not provided - Date: January 19, 2023 7. Contact Form 7 Dynamic Text Extension <= 2.0.3 - Reflected Cross-Site Scripting - CVE ID: Not provided - CVSS Score: 6.1 - Researcher: Not provided - Date: July 24, 2019 Summary The Contact Form 7 – Dynamic Text Extension plugin contains a Stored Cross-Site Scripting vulnerability affecting versions <= 5.0.5. It is recommended to upgrade to version 5.0.6 or higher to remediate this vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

Contact Form 7 – Dynamic Text Extension Stored XSS Vulnerability (CVE-2026-5116)