Contact Form 7 is an excellent WordPress plugin and one of the top choices of free WordPress plugins for contact forms. Contact Form 7 - Dynamic Text Extension (DTX) makes it even more awesome by adding dynamic content capabilities. While default values in Contact Form 7 are static, DTX lets you create pre-populated fields pulled from other locations. Some examples might include:

• Auto-filling a URL or just getting the domain name or path
• Auto-filling a post ID, title, or slug
• Auto-filling a title, URL, or slug for the current page
• Pre-populating a product number
• Referencing other content on the site
• Populating with post or page info
• Populating with the current user's info
• Populating with custom and meta fields
• Generating unique identifiers for support tickets
• Getting a list of post categories or other custom taxonomies
• Getting a value from a cookie
• Getting custom theme modifications
• Any value using custom shortcodes

The possibilities are endless!

View Demo

For over 10 years, DTX only handled <input type="text" /> and <input type="hidden" /> form fields, but version 4 finally introduces more:

• email
• URL
• tel (for phone numbers)
• number
• range (slider)
• textarea (multiline text)
• drop-down menu (select field)
• checkboxes
• radio buttons
• date
• submit (yes, a submit button where you can have dynamic text!)

Please check out the FAQ on our website.

Where do I report security bugs found in this plugin?

Please report security bugs found in the source code of Contact Form 7 - Dynamic Text Extension WordPress plugin through the Wordfence Intelligence Vulnerability Submission Form or the Patchstack Vulnerability Disclosure Program. Both platforms can assist you with verification, CVE assignment, and notify me without publicly disclosing details that could put websites at risk.

Where can I contribute?

Feel free to check out the GitHub repository. Thanks!

5.0.6

Release Date: 06/05/2026

Special thanks to Shane Hollis (@webkiwinz) for these security fixes!

• Security: Fixed stored XSS in admin scan results page; form titles and shortcode key names were echoed without HTML escaping. This addresses security vulnerability CVE-2026-5116 responsibly reported by Satyarth Prakash to Wordfence.
• Security: Fixed CSRF vulnerability on notice dismissal; dismiss-access-keys-notice action now requires a valid nonce.
• Security: Fixed unsanitised $_GET['offset'] parameter; now it's always cast to a non-negative integer before use.
• Security: Fixed potential regex injection in JavaScript get_cookie(); cookie key is now escaped before use in a regex pattern.
• Fix: Fixed switch fall-through logic bug in wpcf7dtx_get_current_var(); missing break statements caused user/term/archive context data to be overwritten by post context data.

Note from Tessa: the AJAX nonce validation that checks !== 1 was intentional to only target the first 12-hour window to be more strict. That AJAX call was intended to run once on page load, so allowing the validation to persist beyond 12 hours is unnecessary.

5.0.5

Release Date: 02/17/2026

• Fix: Fixed a type-o in nonce verification where it compared the value against 0 instead of 1, see support thread.

5.0.4

Release Date: 01/01/2026

• Security: Addressed security vulnerability CVE-2025-13146 responsibly reported by NosleeP++ to Wordfence. Thank you NosleeP++! The JavaScript Fetch/AJAX request now includes nonce verification.

5.0.3

• Fix: Moved settings translations to load as needed instead of immediately hoping to address the Function _load_textdomain_just_in_time was called incorrectly notice added in WordPress core version 6.7, see support thread.

5.0.2

• Security: Addressed security vulnerability responsibly reported by Rafie Muhammad to Patchstack.

Older Releases

Please see our additional changelog.txt file

Minimum Requirements

To ensure your WordPress installation meets these requirements, you can login to your WordPress website and navigate to Tools > Site Health and click on the Info tab. Expand the WordPress, Active Plugins, and Server accordions and compare that information with the details below.

• WordPress version 5.5 or greater
• PHP version 7.4 or greater
• Contact Form 7 version 5.7 or greater

There are three (3) ways to install my plugin: automatically, upload, or manually.

Install Method 1: Automatic Installation

Automatic installation is the easiest option as WordPress handles the file transfers itself and you don’t need to leave your web browser.

1. Log in to your WordPress dashboard.
2. Navigate to Plugins > Add New.
3. Where it says “Keyword” in a dropdown, change it to “Author”
4. In the search form, type “TessaWatkinsLLC” (results may begin populating as you type but my plugins will only show when the full name is there)
5. Once you’ve found my plugin in the search results that appear, click the Install Now button and wait for the installation process to complete.
6. Once the installation process is completed, click the Activate button to activate my plugin.

Install Method 2: Upload via WordPress Admin

This method involves is a little more involved. You don’t need to leave your web browser, but you’ll need to download and then upload the files yourself.

1. Download my plugin from WordPress.org; it will be in the form of a zip file.
2. Log in to your WordPress dashboard.
3. Navigate to Plugins > Add New.
4. Click the Upload Plugin button at the top of the screen.
5. Select the zip file from your local file system that was downloaded in step 1.
6. Click the Install Now button and wait for the installation process to complete.
7. Once the installation process is completed, click the Activate button to activate my plugin.

Install Method 3: Manual Installation

This method is the most involved as it requires you to be familiar with the process of transferring files using an SFTP client.

1. Download my plugin from WordPress.org; it will be in the form of a zip file.
2. Unzip the contents; you should have a single folder named contact-form-7-dynamic-text-extension.
3. Connect to your WordPress server with your favorite SFTP client.
4. Copy the folder from step 2 to the /wp-content/plugins/ folder in your WordPress directory. Once the folder and all of its files are there, installation is complete.
5. Now log in to your WordPress dashboard.
6. Navigate to Plugins > Installed Plugins. You should now see my plugin in your list.
7. Click the Activate button under my plugin to activate it.

Screenshot of the form tag buttons in the form editor of Contact Form 7. The dynamic buttons appear in purple instead of blue to visually set them apart.



The form tag generator screen for the dynamic text form tag



The form tag generator screen for the dynamic hidden form tag



The form tag generator screen for the dynamic email form tag



The form tag generator screen for the dynamic URL form tag



The form tag generator screen for the dynamic phone number (tel) form tag



The form tag generator screen for the dynamic number spinbox form tag



The form tag generator screen for the dynamic sliding range form tag



The form tag generator screen for the dynamic textarea form tag



The form tag generator screen for the dynamic drop-down menu (select) form tag



The form tag generator screen for the dynamic checkboxes form tag



The form tag generator screen for the dynamic radio buttons form tag



The form tag generator screen for the dynamic date form tag



The form tag generator screen for the dynamic submit form tag