CVE-2026-5116 in Contact Form 7 Dynamic Text Extension Plugin
Summary
by MITRE • 08/05/2026
The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.0.5. This is due to insufficient output escaping on form shortcode keys displayed in the admin "Scan Forms for Post Meta and User Data Keys" page. This makes it possible for authenticated attackers, with Editor-level access and above, to inject arbitrary web scripts that execute when an Administrator runs the scan feature.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/05/2026
The Contact Form 7 Dynamic Text Extension plugin presents a significant security vulnerability classified as stored cross-site scripting in versions up to and including 5.0.5. This weakness resides within the administrative interface where form shortcode keys are displayed during the scanning process for post meta and user data keys. The vulnerability stems from inadequate output escaping mechanisms that fail to properly sanitize dynamic content before rendering it in the browser context. Attackers exploiting this flaw must possess at least editor-level privileges within the WordPress environment, making it particularly concerning for sites with less restrictive user management policies.
The technical implementation of this vulnerability involves the plugin's failure to apply proper HTML escaping when presenting form shortcode identifiers on the administrative scan page. When administrators execute the scanning feature, the system processes and displays these keys without adequate sanitization, creating an environment where malicious scripts can be stored within the plugin's data structures. This stored payload executes whenever the vulnerable page is accessed by an administrator, effectively enabling persistent cross-site scripting attacks that can compromise the entire WordPress administrative session.
The operational impact of this vulnerability extends beyond simple script execution, as it provides attackers with a potential foothold for more sophisticated attacks. An attacker with editor privileges can inject malicious JavaScript code that might steal administrator cookies, redirect users to phishing sites, or even execute arbitrary commands on the server if additional vulnerabilities exist. The attack vector is particularly dangerous because it requires minimal user interaction beyond the normal administrative scanning process, making detection difficult and potentially allowing for prolonged exploitation. This vulnerability directly maps to CWE-79 which identifies improper neutralization of input during web page generation, and aligns with ATT&CK technique T1566 for credential access through social engineering.
Mitigation strategies should focus on immediate plugin updates to versions beyond 5.0.5 where the escaping mechanisms have been properly implemented. Administrators should also implement strict role-based access controls limiting editor privileges to only trusted users, and consider additional security measures such as web application firewalls that can detect and block suspicious script injection attempts. Regular security audits of plugin installations and monitoring for unusual administrative activities can help identify potential exploitation attempts. Organizations should also consider implementing content security policies to further reduce the impact of any successful XSS attacks that might occur despite these protections.