CVE-2025-63068: Sevenspark Contact Form 7 – Dynamic Text Extension

Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days.

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in sevenspark Contact Form 7 – Dynamic Text Extension contact-form-7-dynamic-text-extension allows Code Injection.This issue affects Contact Form 7 – Dynamic Text Extension: from n/a through <= 5.0.5.

Affected products

• Sevenspark Contact Form 7 – Dynamic Text Extension: up to and including 5.0.5

Published 2025-12-09. Last modified 2026-10-07.