What’s Vulnerable › Vulnerabilities
CVE-2026-9710: Themeco Cornerstone < 7.8.8 (Premium, bundled with X Theme) - Subscriber+ Arbitrary User Password Hash Disclosure
- Severity: high (CVSS 7.7 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-06-24 · updated 2026-06-25
Description
The Cornerstone WordPress plugin before 7.8.8 does not enforce capability checks on one of its CSS-preview request handlers, and exposes the nonce needed to call it to every logged-in user on any wp-admin page, allowing any authenticated user to evaluate dynamic content tokens against arbitrary users and disclose their sensitive metadata including raw password hashes. This affects the premium co Cornerstone page builder distributed bundled with the X , not the unrelated free `cornerstone` Cornerstone WordPress plugin before 7.8.8 (v0.8.x) on the .org repository.
Affected products
- Cornerstone: from 3.0.0 before 7.8.8 — fixed in 7.8.8
How to fix
Upgrade to a fixed version: Cornerstone 7.8.8. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-9710 or the next vulnerability affects your stack