Known vulnerabilities in DTX – Dynamic Text Extension for Contact Form 7

Extends Contact Form 7 by adding dynamic form fields that accepts shortcodes to prepopulate form fields with default values and dynamic placeholders.

7Reported vulnerabilities

6.5Highest CVSS score

5.0.7Latest version

100,000+Active installs

What to do now

Update DTX – Dynamic Text Extension for Contact Form 7 to 5.0.6 or later. 5 of these have a fixed version available. Updating resolves them.

Plugin last updated: August 4, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVE	Severity	Exploit probability next 30 days	Affected versions	Fixed in	Published
CVE-2025-13146	Medium 6.5	0.5%	0 to 5.0.3 (inclusive)	—	July 22, 2026
CVE-2025-63068	Medium 6.5	0.3%	5.0.5 and earlier	—	September 26, 2025
WF-fa821005-9593-4a84-b4b4-af746da4d6b9	Medium 6.4	—	2.0.3 and earlier	`3.0.0`	January 19, 2023
WF-59cefa5d-f270-48e1-bb3e-98f710a055d8	Medium 6.1	—	Before 2.0.3	`2.0.3`	July 24, 2019
CVE-2026-5116	Medium 4.4	0.3%	0 to 5.0.5 (inclusive)	`5.0.6`	August 5, 2026
CVE-2024-56218	Medium 4.3	0.1%	5.0.1 and earlier	`5.0.2`	December 19, 2024
CVE-2024-10084	Medium 4.3	0.4%	Before 4.5.1	`4.5.1`	November 5, 2024

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.