The vulnerability arises from improper neutralization of input during web page generation, allowing Stored XSS to be injected into the Cornerstone plugin. An attacker can embed malicious scripts that will execute in the browsers of any user who views the affected page, potentially leading to data theft, session hijacking, or defacement. The weakness is identified as CWE‑79, reflecting insufficient input validation.

The vulnerability affects the THEMECO Cornerstone WordPress plugin with versions up to and including 7.7.3. No specific alternative products are listed. Systems running a WordPress site with Cornerstone 7.7.3 or earlier are impacted.

The CVSS score of 6.5 classifies the issue as high‑medium severity but the EPSS score of less than 1% indicates a low probability of exploitation at present. The vulnerability is currently not listed in the CISA KEV catalog. Based on the stored‑XSS description, the attack vector is inferred to be web‑application based, requiring the attacker to supply malicious input that is subsequently rendered in the user’s browser. No exotic prerequisites beyond accessing the vulnerable input field are reported, making the exploit relatively straightforward for an attacker with basic web knowledge.