PT-2026-63336 · Sevenspark · Contact Form 7 – Dynamic Text Extension

Nosleep · CVE-2025-13146 · Published 2026-07-22 · Updated 2026-07-22

NVD

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

The The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.0.6. This is due to the software allowing users to execute an action that does not properly validate a value before running do shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. The vulnerability was partially patched in version 5.0.4.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-13146

Affected Products

Contact Form 7 – Dynamic Text Extension

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-13146 · Security Note
• https://plugins.trac.wordpress.org/changeset/3430784 · Note
• https://plugins.trac.wordpress.org/browser/contact-form-7-dynamic-text-extension/trunk/includes/utilities.php#L265 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/3e5ad3a7-03c5-4085-b330-bc77e7e46cea?source=cve · Note
• https://plugins.trac.wordpress.org/browser/contact-form-7-dynamic-text-extension/trunk/contact-form-7-dynamic-text-extension.php#L765 · Note
• https://plugins.trac.wordpress.org/browser/contact-form-7-dynamic-text-extension/trunk/contact-form-7-dynamic-text-extension.php#L782 · Note