Cornerstone

Cornerstone has 7 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2026; 6 are fixed and 1 remains unpatched as of September 2026. Their average CVSS score is 6.1, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 1 high. 2026 was the busiest year with 4 disclosures.

The most common weakness is Cross-Site Scripting, behind 3 of the records (43%). Other recurring categories include Missing Authorization, Code Injection.

6 of the records (86%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2025.

3 independent researchers contributed these findings, most of them (2) reported by Nguyen Ba Khanh. Cornerstone is installed on roughly 30,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSMedium
6.1/ 10
Patch Coverage86%
Open

1

Fixed

6

Get automatic notifications for all Cornerstone vulnerabilities before they are exploited.

Most severe open issueCVSS 6.4CVE-2025-63072

Cornerstone <= 7.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

7 records
Plugin Profile
Latestv0.8.1

Cornerstone

Archetyped

Author

Archetyped

4.0(6)
80/100
Last Updated
2026-09-12 (19h ago)
Active Installs
30,000+
Downloads
70,913
Requires WP
5.3+
Requires PHP
0+
Tested up to
WP 7.1
Created
2010-12-30 (16y ago)

Cornerstone makes WordPress practical for any type of site by enhancing its content management capabilities. Too long have we had to resort to hacks like using categories in menus to build a pseudo site structure (you know what I’m talking about). Cornerstone enhances your WordPress site in several ways. One of the most useful features is one that allows WordPress to be used for sites that go beyond just blogging– Posts in Sections. Create a section, add posts to it, they show up when visitors navigate to that section. Simple as that. It really is, but because you’re awesome here’s a tutorial on how to do it. Thanks for the Support! The support from the users that love Cornerstone is huge. You can support Cornerstone’s future development and help to make it even better by donating or even just by sending me a nice message 🙂 Donate to Cornerstone Features ”NEW: Content Types” – Add custom fields to default (posts, pages, etc.) and custom (events, properties, etc.) post types Posts in Sections (see above for more info. Why are you reading from the bottom up?) Structured permalinks – post permalinks are based on the section they are in (e.g. /section-name/post-name/) RSS for Sections – Let users subscribe to and receive updates for specific sections on the site. Next Up Template functionality – enhanced page titles, featured content, etc. And more, which is where your feedback comes in. Plugin home page

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C