CVE-2025-63072

MediumCVSS 6.5

Published: 09/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

9th percentile - higher than 9% of all known CVEs

Summary

Stored XSS vulnerability in Cornerstone plugin by THEMECO. Improper input neutralization during web page generation allows persistent script injection.

Risk Assessment

Malicious script can be stored on the server and executed every time the page is viewed, potentially leading to data theft, admin account takeover, or malware distribution.

Recommendation

Update Cornerstone plugin to a version newer than 7.7.3, which includes a fix for this vulnerability.

Other vulnerabilities in Cornerstone

See all

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in THEMECO Cornerstone cornerstone allows Stored XSS.This issue affects Cornerstone: from n/a through <= 7.7.3.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS