Improper neutralization of input during page generation in the Dynamic Text Field For Contact Form 7 plugin allows a stored cross‑site scripting flaw. If an attacker supplies malicious code to a form field, that code will be stored and later rendered on other users’ browsers without encoding. This can lead to theft of session cookies, defacement, or delivery of malware to visitors who load a page containing the vulnerable field. The flaw resides in CWE‑79 and is reflected by a CVSS score of 6.5, indicating moderate risk to confidentiality and integrity of user sessions.

The issue affects versions of the Dynamic Text Field For Contact Form 7 plugin released by silverplugins217, from the initial launch up to and including version 1.0. All WordPress sites running that plugin and any form that uses dynamic text fields are susceptible.

The CVSS rating of 6.5 marks it as a moderate severity vulnerability. The EPSS score of less than 1% suggests that exploitation attempts are currently rare, and the vulnerability is not listed in the CISA KEV catalog. Attackers would most likely exploit the flaw by submitting payloads through any exposed dynamic text field; the attack vector is through the web application itself, and victims are other users who view the form output.