CVE-2026-5116 Overview
CVE-2026-5116 is a Stored Cross-Site Scripting (XSS) vulnerability in the Contact Form 7 – Dynamic Text Extension plugin for WordPress. The flaw affects all versions up to and including 5.0.5. The plugin fails to properly escape form shortcode keys before rendering them on the admin "Scan Forms for Post Meta and User Data Keys" page. Authenticated attackers with Editor-level access or higher can inject arbitrary JavaScript that executes in an Administrator's browser session when the scan feature is used. The issue is tracked under [CWE-79] and was addressed in version 5.0.6.
Critical Impact
Editor-level attackers can inject scripts that execute in Administrator sessions, enabling session theft, privilege escalation, or arbitrary actions in the WordPress admin context.
Affected Products
- Contact Form 7 – Dynamic Text Extension plugin for WordPress, versions up to and including 5.0.5
- WordPress sites with Editor-level or higher user accounts using the affected plugin
- Fixed in Contact Form 7 – Dynamic Text Extension version 5.0.6
Discovery Timeline
- 2026-08-05 - CVE-2026-5116 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-5116
Vulnerability Analysis
The vulnerability is a Stored Cross-Site Scripting flaw classified under [CWE-79]. The affected code paths reside in includes/admin/settings.php at approximately lines 544 and 559 of the plugin's 5.0.4 tag. These locations render form shortcode keys directly into the admin scan results page without adequate output escaping.
An authenticated user with Editor privileges or higher can create or modify a Contact Form 7 form that contains a malicious shortcode key. When an Administrator later executes the "Scan Forms for Post Meta and User Data Keys" feature, the crafted payload is rendered into the admin page and executes in the Administrator's browser context.
The attack requires high privileges and user interaction from the Administrator running the scan, which limits practical exploitation. The EPSS score is 0.297%.
Root Cause
The root cause is insufficient output escaping when rendering user-controlled form shortcode keys inside the admin settings interface. The plugin trusts the shortcode key values retrieved from stored form definitions and outputs them into HTML without applying WordPress escaping functions such as esc_html() or esc_attr().
Attack Vector
Exploitation proceeds in two stages. First, an authenticated Editor injects a malicious shortcode key value into a Contact Form 7 form. Second, an Administrator triggers the scan feature, at which point the stored payload executes in the Administrator's session. The vulnerability is exploitable over the network but requires elevated privileges to plant the payload. No exploitation code is being published; refer to the Wordfence Vulnerability Report for advisory details.
Detection Methods for CVE-2026-5116
Indicators of Compromise
- Unexpected <script> tags, event handlers, or HTML entities embedded within Contact Form 7 form shortcode key definitions stored in the WordPress database.
- Administrator sessions performing unauthorized actions shortly after visiting the plugin's scan admin page.
- Modifications to Contact Form 7 forms by Editor-level accounts that do not correspond to legitimate content changes.
Detection Strategies
- Audit Contact Form 7 form definitions in the wp_posts table for shortcode content containing HTML or JavaScript syntax in key attributes.
- Review WordPress audit logs for form edits performed by non-Administrator accounts followed by scan feature usage.
- Compare installed plugin versions against 5.0.6 or later across managed WordPress environments.
Monitoring Recommendations
- Enable WordPress activity logging to track form creation and modification events tied to Editor accounts.
- Monitor outbound HTTP requests from admin sessions for signs of session token exfiltration.
- Alert on unexpected administrative changes such as new user creation or plugin installations that follow scan page visits.
How to Mitigate CVE-2026-5116
Immediate Actions Required
- Update the Contact Form 7 – Dynamic Text Extension plugin to version 5.0.6 or later on all WordPress installations.
- Review Editor and higher-privileged accounts for legitimacy and remove unnecessary elevated access.
- Inspect existing Contact Form 7 forms for suspicious shortcode key content and sanitize or remove any injected payloads.
Patch Information
The vendor released version 5.0.6 of the Contact Form 7 – Dynamic Text Extension plugin, which adds proper output escaping to the affected admin settings code paths. Refer to the WordPress Change Set 5.0.6 for the exact code changes, and see the Wordfence Vulnerability Report for advisory context.
Workarounds
- Avoid running the "Scan Forms for Post Meta and User Data Keys" feature until the plugin is updated to 5.0.6 or later.
- Restrict Editor-level access to trusted users only, since exploitation requires that privilege level.
- Deploy a Web Application Firewall (WAF) with rules that block script tags and event handlers in form field submissions to WordPress admin endpoints.
# Configuration example
# Update the plugin via WP-CLI on affected WordPress hosts
wp plugin update contact-form-7-dynamic-text-extension --version=5.0.6
wp plugin get contact-form-7-dynamic-text-extension --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
