Skip to content
Home » Blog » Computer Science » Web Development » WordPress » Plugins » Contact Form 7 – Dynamic Text Extension Security Vulnerability Patched in version 5.0.4

Contact Form 7 – Dynamic Text Extension Security Vulnerability Patched in version 5.0.4

3 minute read

Update: April 8, 2026

Patchstack reviewed the patch submitted in version 5.0.5 on March 24, 2026, and marked it as incomplete, meaning the immediate vulnerability has been patched but the security around it could be hardened even more. These additional security features will be added in the upcoming version 6 of Contact Form 7 – Dynamic Text Extension. I do not yet have a timeline for its release.

Update: February 2026

Patchstack always displays the latest version of the plugin as vulnerable regardless of which version was verified to be vulnerable in the report (up to and including 5.0.3). I submitted the update to Patchstack back in January and it is still pending on their end.

Thanks for submitting a patch. The triage team is in process of validating it. Report was published on 26 Sep, 2025. WordPress Contact Form 7 - Dynamic Text Extension plugin <= 5.0.4 is vulnerable to Content Injection. Vendor notified 2 Sept. 2025. Patch submitted 5 Jan, 2026. Patch approved [null]. Published to db 9 Dec. 2025.
Screenshot of Patchstack VPD dashboard showing that a patch was submitted to them on January 5, 2026 but it is still in review by their triage team as of February 11, 2026.

I would also like to note that WordPress.org made an update a year ago that affects who is displayed as the primary author of a WordPress plugin. This change had a detrimental affect because Patchstack reached out to the plugin owner, not the plugin author, which caused the severe delay in patching this vulnerability. I’ve since then verified myself as the plugin author in Patchstack so I should get vulnerability reports going forward.

Original Report Details

Hello! I released version 5.0.4 of Contact Form 7 – Dynamic Text Extension today (January 1, 2026) to patch a security vulnerability. Please see the full details below. Thank you!

ClassificationImproper Control of Generation of Code (“Code Injection”)
DescriptionThe vulnerability allows users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Exploit ExampleA malicious actor could exploit the vulnerability to inject their own content (like phishing content) into pages and posts of your website.
Impact“This security issue has a low severity impact and is unlikely to be exploited.” — Patchstack
Severity
(scale out of 10)		6.5 (Medium) – Wordfence
5.3 (Medium) – Patchstack
5.9 (Medium) – averaged
PriorityLow – Patchstack
Report(s)1. Wordfence by Noslee++ (not yet published publicly)
2. Patchstack e22da71e8eaa reported by Najib Sinjari
3. Wordfence public record of Patchstack report
CVECVE-2025-13146 – Wordfence
CVE-2025-63068 – Patchstack
Affected versions<= 5.0.3
Patched versions>= 5.0.4

If the plugin is set to update automatically on your site(s), then there’s nothing else you need to do.

If you need support with my plugin, please check out the support forums or create a post. Please report security bugs found in the source code of Contact Form 7 – Dynamic Text Extension WordPress plugin through the Wordfence Intelligence Vulnerability Submission Form or the Patchstack Vulnerability Disclosure Program. Both platforms will assist you with verification, CVE assignment, and notify me—though I prefer Wordfence because logging into Patchstack’s passwordless VDP requires sending an email with a login link every time which takes centuries to receive in my inbox (if not spam) and there is no “remember me” option. I’m not a fan of a login process that takes 15+ minutes…

Editor's Note: This article was originally published on , and was last reviewed on .

Tags:

Related Post Module Attributes Before

array(29) {
  ["post_type"]=>
  bool(false)
  ["post_id"]=>
  string(5) "23065"
  ["exclude"]=>
  string(2) "on"
  ["title"]=>
  string(27) "You might also like…"
  ["description"]=>
  string(0) ""
  ["max"]=>
  string(1) "4"
  ["post_ids"]=>
  string(0) ""
  ["exclude_ids"]=>
  string(0) ""
  ["is_series"]=>
  string(0) ""
  ["featured_term"]=>
  string(0) ""
  ["exclude_terms"]=>
  string(0) ""
  ["exclusive"]=>
  string(0) ""
  ["order"]=>
  string(4) "DESC"
  ["show_image"]=>
  string(2) "on"
  ["image_size"]=>
  string(6) "medium"
  ["menu_order_label"]=>
  string(0) ""
  ["show_order_label"]=>
  string(2) "on"
  ["show_date"]=>
  string(2) "on"
  ["show_meta_keys"]=>
  string(2) "on"
  ["show_modified"]=>
  string(0) ""
  ["show_author"]=>
  string(0) ""
  ["show_categories"]=>
  string(0) ""
  ["show_primary_category"]=>
  string(0) ""
  ["show_description"]=>
  string(0) ""
  ["show_reading_time"]=>
  string(2) "on"
  ["show_cta"]=>
  string(2) "on"
  ["cta"]=>
  string(9) "Read more"
  ["autoplay"]=>
  string(0) ""
  ["allow_sticky"]=>
  string(0) ""
}

Related Post Module Attributes

array(29) {
  ["post_type"]=>
  bool(false)
  ["post_id"]=>
  string(5) "23065"
  ["exclude"]=>
  string(2) "on"
  ["title"]=>
  string(27) "You might also like…"
  ["description"]=>
  string(0) ""
  ["max"]=>
  string(1) "4"
  ["post_ids"]=>
  string(0) ""
  ["exclude_ids"]=>
  string(0) ""
  ["is_series"]=>
  string(0) ""
  ["featured_term"]=>
  string(0) ""
  ["exclude_terms"]=>
  string(0) ""
  ["exclusive"]=>
  string(0) ""
  ["order"]=>
  string(4) "DESC"
  ["show_image"]=>
  string(2) "on"
  ["image_size"]=>
  string(6) "medium"
  ["menu_order_label"]=>
  string(0) ""
  ["show_order_label"]=>
  string(2) "on"
  ["show_date"]=>
  string(2) "on"
  ["show_meta_keys"]=>
  string(2) "on"
  ["show_modified"]=>
  string(0) ""
  ["show_author"]=>
  string(0) ""
  ["show_categories"]=>
  string(0) ""
  ["show_primary_category"]=>
  string(0) ""
  ["show_description"]=>
  string(0) ""
  ["show_reading_time"]=>
  string(2) "on"
  ["show_cta"]=>
  string(2) "on"
  ["cta"]=>
  string(9) "Read more"
  ["autoplay"]=>
  string(0) ""
  ["allow_sticky"]=>
  string(0) ""
}

You might also like…

    array(7) {
  ["post_id"]=>
  int(11166)
  ["classes"]=>
  array(1) {
    [0]=>
    string(27) "col-xs-12 col-sm-6 col-md-3"
  }
  ["image"]=>
  array(2) {
    ["show"]=>
    bool(true)
    ["size"]=>
    string(6) "medium"
  }
  ["order"]=>
  array(3) {
    ["label"]=>
    string(0) ""
    ["show"]=>
    bool(true)
    ["date"]=>
    bool(true)
  }
  ["show"]=>
  array(8) {
    ["meta"]=>
    bool(true)
    ["modified"]=>
    bool(false)
    ["author"]=>
    bool(false)
    ["categories"]=>
    bool(false)
    ["category"]=>
    bool(false)
    ["description"]=>
    bool(false)
    ["time"]=>
    bool(true)
    ["series"]=>
    NULL
  }
  ["cta"]=>
  array(2) {
    ["show"]=>
    bool(true)
    ["label"]=>
    string(9) "Read more"
  }
  ["force_new"]=>
  bool(true)
}

  • Accessible Reading WordPress Plugin

    1 minute read

    Read more

    • array(7) {
  ["post_id"]=>
  int(23142)
  ["classes"]=>
  array(1) {
    [0]=>
    string(27) "col-xs-12 col-sm-6 col-md-3"
  }
  ["image"]=>
  array(2) {
    ["show"]=>
    bool(true)
    ["size"]=>
    string(6) "medium"
  }
  ["order"]=>
  array(3) {
    ["label"]=>
    string(0) ""
    ["show"]=>
    bool(true)
    ["date"]=>
    bool(true)
  }
  ["show"]=>
  array(8) {
    ["meta"]=>
    bool(true)
    ["modified"]=>
    bool(false)
    ["author"]=>
    bool(false)
    ["categories"]=>
    bool(false)
    ["category"]=>
    bool(false)
    ["description"]=>
    bool(false)
    ["time"]=>
    bool(true)
    ["series"]=>
    NULL
  }
  ["cta"]=>
  array(2) {
    ["show"]=>
    bool(true)
    ["label"]=>
    string(9) "Read more"
  }
  ["force_new"]=>
  bool(true)
}

  • AI is not going to replace Web Developers, it’s going to reveal to everyone why we’re valuable

    8 minute read

    Read more

    • array(7) {
  ["post_id"]=>
  int(12892)
  ["classes"]=>
  array(1) {
    [0]=>
    string(27) "col-xs-12 col-sm-6 col-md-3"
  }
  ["image"]=>
  array(2) {
    ["show"]=>
    bool(true)
    ["size"]=>
    string(6) "medium"
  }
  ["order"]=>
  array(3) {
    ["label"]=>
    string(0) ""
    ["show"]=>
    bool(true)
    ["date"]=>
    bool(true)
  }
  ["show"]=>
  array(8) {
    ["meta"]=>
    bool(true)
    ["modified"]=>
    bool(false)
    ["author"]=>
    bool(false)
    ["categories"]=>
    bool(false)
    ["category"]=>
    bool(false)
    ["description"]=>
    bool(false)
    ["time"]=>
    bool(true)
    ["series"]=>
    NULL
  }
  ["cta"]=>
  array(2) {
    ["show"]=>
    bool(true)
    ["label"]=>
    string(9) "Read more"
  }
  ["force_new"]=>
  bool(true)
}

  • How to Force JavaScript to use Async/Defer in WordPress 6.3

    4 minute read

    Read more

    • array(7) {
  ["post_id"]=>
  int(11238)
  ["classes"]=>
  array(1) {
    [0]=>
    string(27) "col-xs-12 col-sm-6 col-md-3"
  }
  ["image"]=>
  array(2) {
    ["show"]=>
    bool(true)
    ["size"]=>
    string(6) "medium"
  }
  ["order"]=>
  array(3) {
    ["label"]=>
    string(0) ""
    ["show"]=>
    bool(true)
    ["date"]=>
    bool(true)
  }
  ["show"]=>
  array(8) {
    ["meta"]=>
    bool(true)
    ["modified"]=>
    bool(false)
    ["author"]=>
    bool(false)
    ["categories"]=>
    bool(false)
    ["category"]=>
    bool(false)
    ["description"]=>
    bool(false)
    ["time"]=>
    bool(true)
    ["series"]=>
    NULL
  }
  ["cta"]=>
  array(2) {
    ["show"]=>
    bool(true)
    ["label"]=>
    string(9) "Read more"
  }
  ["force_new"]=>
  bool(true)
}

  • First Official WordPress Plugin Released — Socialized

    3 minute read

    Read more

Nobody has commented on this yet, be the first!

Your email address will not be published. Required fields are marked *