The vulnerability is an improper neutralization of user‑supplied input during web page generation, resulting in a reflected XSS flaw in the RylanH Storyform plugin. An attacker could inject malicious JavaScript that is executed in the browser of any user who views a crafted form page, enabling theft of session cookies, credential phishing, or other client‑side attacks. The weakness resides in CWE‑79 and can affect the confidentiality and integrity of user data by running arbitrary code in the victim’s context. The attack would require a crafted URL or form that a victim engages with; this is inferred from the reflected nature of the flaw.

Affected systems are websites running the WordPress Storyform plugin version 0.6.14 or earlier. All releases from the initial public build (n/a) through 0.6.14 are vulnerable. The plugin is developed by RylanH and is identified in the CNA list as RylanH:Storyform.

The CVSS score of 7.1 indicates a high severity for reflected XSS. However, the EPSS score is less than 1 %, suggesting exploitation is currently rare. The vulnerability is not listed in the CISA KEV catalog, so no publicly known exploits exist at the time of this analysis. Based on the description, it is inferred that the attack would need a crafted URL or form payload that a victim clicks on or visits, so it is typically a phishing or lure scenario.