CVE-2026-5116mediumCWE-79

CVE-2026-5116: falha de média gravidade em sevenspark DTX – Dynamic Text Extension for…

Contact Form 7 – Dynamic Text Extension <= 5.0.5 - Authenticated (Editor+) Stored Cross-Site Scripting

Publicada em

Seguir esta CVE+ Monitorar DTX – Dynamic Text Extension for Contact Form

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 4.4epss 0.3%
The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.0.5. This is due to insufficient output escaping on form shortcode keys displayed in the admin "Scan Forms for Post Meta and User Data Keys" page. This makes it possible for authenticated attackers, with Editor-level access and above, to inject arbitrary web scripts that execute when an Administrator runs the scan feature.
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
Produtos afetados
sevenspark · DTX – Dynamic Text Extension for Contact Form 7
CVEs relacionadas — sevenspark DTX – Dynamic Text Extension for…

No mesmo produto, das mais perigosas para as menos.

CVE-2025-13146MEDIUMContact Form 7 – Dynamic Text Extension <= 5.0.7 - Unauthenticated Arbitrary Shortcode ExecutionEPSS 0.5%