The vulnerability is an improper neutralization of script‑related HTML tags that allows an attacker to inject arbitrary HTML or JavaScript into web pages rendered by the plugin. This code injection can lead to defacement, phishing, or potentially theft of user session data. The weakness is classified as CWE‑80, a basic cross‑site scripting vulnerability.

WordPress sites that include the sevenspark Contact Form 7 – Dynamic Text Extension plugin version 5.0.5 or earlier are affected. The issue applies to all installations using the plugin's dynamic text feature, regardless of the site's theme or other plugins.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score is below 1 %, suggesting a very low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Exploitation would most likely occur through a crafted form submission that includes malicious scripts, meaning the attack vector is web‑based and can be performed from an external attacker.