PT-2026-21037 · Storyform · Storyform

Published 2026-02-20 · Updated 2026-02-25 · CVE-2025-53233

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions RylanH Storyform versions through 0.6.14

Description The software contains a flaw due to improper neutralization of input during web page generation, specifically a Reflected Cross-site Scripting issue. This allows for the execution of malicious scripts through crafted input. The affected component is Storyform.

Recommendations Versions prior to 0.6.14 should be updated.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-53233

Affected Products

Storyform

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-53233 · Security Note
• https://patchstack.com/database/Wordpress/Plugin/storyform/vulnerability/wordpress-storyform-plugin-0-6-14-cross-site-scripting-xss-vulnerability?_s_id=cve · Note
• https://twitter.com/cracbot/status/2026613221952729290 · Twitter Post
• https://twitter.com/CVEnew/status/2025524078132572548 · Twitter Post