The vulnerability CVE-2025-63068 in sevenspark's Contact Form 7 – Dynamic Text Extension plugin arises from improper neutralization of script-related HTML tags in web pages, enabling basic cross-site scripting (XSS) attacks. This can allow an attacker to inject code via the contact form extension. The affected versions include all versions up to 5.0.5. The CVSS 3.1 base score is 5.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges or user interaction required, and limited confidentiality impact. No patch or remediation details are provided in the available data.

Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages served by the vulnerable plugin, potentially leading to limited confidentiality impacts such as theft of user data or session information. There is no indication of integrity or availability impacts. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or limiting use of the affected plugin version. Monitor vendor channels for updates and apply patches promptly once released.