CVE-2026-9710Disclosure

LOWCVSS 7.7 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The Cornerstone WordPress plugin before 7.8.8 does not enforce capability checks on one of its CSS-preview request handlers, and exposes the nonce needed to call it to every logged-in user on any wp-admin page, allowing any authenticated user to evaluate dynamic content tokens against arbitrary users and disclose their sensitive metadata including raw password hashes. This affects the premium co Cornerstone page builder distributed bundled with the X , not the unrelated free `cornerstone` Cornerstone WordPress plugin before 7.8.8 (v0.8.x) on the .org repository.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

https://wpscan.com/vulnerability/4fc21e38-f2df-41be-86b7-a897483574bb/

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

1 mentions across 1 observed day

What's happening

Technical details provided in 1 signal
Disclosure: 1 classified signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Disclosure

1100.0%

Referenced assets1 URL

By indicator

https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-9710

Full discourse1 post

Vulmon Vulnerability Feed@VulmonFeeds91d
Disclosure
CVE-2026-9710 Authenticated Information Disclosure in Cornerstone WordPress Plugin Before 7.8.8 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-9710
Post summary
The text announces CVE-2026-9710, an authenticated information disclosure flaw affecting Cornerstone WordPress plugin versions prior to 7.8.8.
00000110
4.1K followersView on X

Explore more

Back to dashboard