HIGH
sevenspark
CVE published 2026-10-10
CVE-2026-62043
CVE-2026-62043 is a high-severity vulnerability in Contact Form 7 – Dynamic Text Extension plugin versions <= 5.0.7, allowing unauthenticated sensitive data exposure.
sevenspark CVE debriefs
These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
MEDIUM
sevenspark
CVE published 2026-08-05
CVE-2026-5116
The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.0.5. This is due to insufficient output escaping on form shortcode keys displayed in the admin 'Scan Forms for Post Meta and User Data Keys' page. This makes it possible for authenticated attackers, with Editor-level access and above, to inject arbitrary web [truncated]
MEDIUM
sevenspark
CVE published 2026-07-22
CVE-2025-13146
The Contact Form 7 – Dynamic Text Extension plugin for WordPress has a vulnerability allowing arbitrary shortcode execution. This issue, present in all versions up to and including 5.0.7, stems from inadequate validation before running do_shortcode. Consequently, unauthenticated attackers can execute arbitrary shortcodes. A partial patch was implemented in version 5.0.4.