The Contact Form 7 – Dynamic Text Extension plugin for WordPress versions up to 5.0.5 contains a stored cross-site scripting vulnerability (CWE-79). This occurs due to improper neutralization of input during web page generation, specifically insufficient output escaping of form shortcode keys on the admin scan page. An attacker with Editor-level privileges or above can inject arbitrary JavaScript code that executes in the context of an Administrator when the scan feature is run, potentially leading to session hijacking or other script-based attacks.

The vulnerability allows authenticated users with Editor-level access or higher to inject and store malicious scripts that execute in an Administrator's browser when they run the scan feature. This can lead to limited confidentiality and integrity impacts, such as theft of administrator session tokens or manipulation of admin interface content. The CVSS score of 4.4 reflects a medium severity with network attack vector, high attack complexity, and requiring privileges but no user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Editor-level access to trusted users only and avoid running the scan feature from untrusted environments. Monitor for updates from the vendor sevenspark regarding an official fix or mitigation.