CVE-2026-5116 sevenspark CVE debrief

Who should care

Administrators and users with Editor-level access and above using the Contact Form 7 – Dynamic Text Extension plugin for WordPress should verify and update the plugin to prevent potential XSS attacks. Additionally, security teams and vulnerability management teams should review the vulnerability and implement necessary mitigations to protect against potential attacks.

Technical summary

The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.0.5. This is due to insufficient output escaping on form shortcode keys displayed in the admin 'Scan Forms for Post Meta and User Data Keys' page. This makes it possible for authenticated attackers, with Editor-level access and above, to inject arbitrary web scripts that execute when an Administrator runs the scan feature.

Defensive priority

Authenticated attackers with Editor-level access could inject web scripts via the Contact Form 7 – Dynamic Text Extension plugin; verify and limit admin scan feature usage.

Recommended defensive actions

• Verify plugin version and update to 5.0.6 or later
• Limit admin scan feature usage to trusted users
• Monitor for suspicious admin activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The Contact Form 7 – Dynamic Text Extension plugin for WordPress has a stored XSS vulnerability due to insufficient output escaping. This vulnerability allows authenticated attackers with Editor-level access and above to inject arbitrary web scripts that execute when an Administrator runs the scan feature. To verify and mitigate this vulnerability, defenders should check the plugin version, limit admin scan feature usage, and monitor for suspicious admin activity. The vulnerability affects all versions up to, and including, 5.0.5, and the fix is available in version 5.0.6 or later.

Official resources