Satyarth Prakash

**Name of the Vulnerable Software and Affected Versions** Contact Form 7 – Dynamic Text Extension versions prior to 5.0.6 **Description** Stored Cross-Site Scripting occurs due to insufficient output escaping on form shortcode keys displayed in the admin "Scan Forms for Post Meta and User Data Keys" page. Authenticated attackers with Editor-level access and above can inject arbitrary web scripts that execute when an Administrator runs the scan feature. Cross-Site Scripting is a technique where malicious scripts are injected into trusted websites. **Recommendations** Update to version 5.0.6 or later.