WordPress plugin
DTX – Dynamic Text Extension for Contact Form 7 security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical0
- High0
- Medium9
- Low0
All DTX – Dynamic Text Extension for Contact Form 7 vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium5.3 | Unauthenticated Information Exposure ≤5.0.7No patch available | CVE-2026-62043 | |
| Medium4.4 | Authenticated (Editor+) Stored Cross-Site Scripting ≤5.0.5Update to 5.0.6 | CVE-2026-5116 | |
| Medium6.5 | Unauthenticated Arbitrary Shortcode Execution ≤5.0.7No patch available | CVE-2025-13146 | |
| Medium6.5 | Unauthenticated Arbitrary Shortcode Execution ≤5.0.5No patch available | CVE-2025-63068 | |
| Medium4.3 | Cross-Site Request Forgery ≤5.0.1Update to 5.0.2 | CVE-2024-56218 | |
| Medium4.3 | Information Disclosure via Shortcode ≤4.5Update to 4.5.1 | CVE-2024-10084 | |
| Medium4.3 | Insecure Direct Object Reference ≤4.1.0Update to 4.2.0 | CVE-2023-6630 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤2.0.3Update to 3.0.0 | — | |
| Medium6.1 | Reflected Cross-Site Scripting <2.0.3Update to 2.0.3 | — |
- Medium5.3Unauthenticated Information Exposure
≤5.0.7No patch available
- Medium4.4Authenticated (Editor+) Stored Cross-Site Scripting
≤5.0.5Update to 5.0.6
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
≤5.0.7No patch available
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
≤5.0.5No patch available
- Medium4.3Cross-Site Request Forgery
≤5.0.1Update to 5.0.2
- Medium4.3Information Disclosure via Shortcode
≤4.5Update to 4.5.1
- Medium4.3Insecure Direct Object Reference
≤4.1.0Update to 4.2.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
≤2.0.3Update to 3.0.0
- Medium6.1Reflected Cross-Site Scripting
<2.0.3Update to 2.0.3
DTX – Dynamic Text Extension for Contact Form 7: common questions
Does DTX – Dynamic Text Extension for Contact Form 7 have known vulnerabilities?
Yes. VulnCrest Radar lists 9 known vulnerabilities in DTX – Dynamic Text Extension for Contact Form 7: 9 medium. At least one is not fixed in the latest version.
How do I check which version of DTX – Dynamic Text Extension for Contact Form 7 I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent DTX – Dynamic Text Extension for Contact Form 7 vulnerability?
CVE-2026-62043, published Oct 9, 2026: DTX – Dynamic Text Extension for Contact Form 7 <= 5.0.7 - Unauthenticated Information Exposure. Severity: Medium (CVSS 5.3).
Is any DTX – Dynamic Text Extension for Contact Form 7 vulnerability listed in CISA KEV?
No. None of the known DTX – Dynamic Text Extension for Contact Form 7 vulnerabilities is currently listed in the CISA KEV catalog.