Plugin vulnerabilities stay unpatched, no fix date
Known security vulnerabilities in the plugin stay unpatched for months, and site owners get no fix date or clear exposure guidance.
Tier I · Proven The best-established problems.
13 public reports · first reported 9 December 2025 · last reported 9 October 2026
What's going wrong
Site owners using the DTX Dynamic Text Extension plugin for Contact Form 7 keep finding published security advisories against it, including content injection and unauthenticated shortcode execution, while no fixed release or timeline appears. Hosting providers and security scanners flag their sites even after they update to the newest version, so owners cannot tell whether they are exposed or when the problem will be closed. Some report that their questions about fix timing were ignored or removed. The gap creates an opening for independent advisories, virtual patching, and a clear exposure checker that tells owners what to do today.
AI-assisted: written with the help of AI from the reports.
Products affected
DTX – Dynamic Text Extension for Contact Form 7.
Related problems
Who has this problem
1 business found.
Unlock them at the top of this page — $19.
All sales are final — no refunds.
Each business's name, the address it published, and the page it was published on. Paid through Stripe; you get a private page to bookmark, with a CSV download.