Cornerstone Security & Risk Analysis

The plugin "cornerstone" v0.8.1 presents a mixed security posture. While the attack surface appears to be minimal with no identified AJAX handlers, REST API routes, shortcodes, or cron events, the code signals reveal significant concerns. The presence of "create_function", a dangerous PHP function known for potential security risks, is a notable weakness. Furthermore, a concerning 58% of output escaping is not properly implemented, indicating a high risk of Cross-Site Scripting (XSS) vulnerabilities. The taint analysis also shows that 60% of analyzed flows have unsanitized paths, though no critical or high-severity issues were found in this specific analysis.

The vulnerability history is a major red flag, with three known CVEs, one of which remains unpatched. The common vulnerability type being Cross-Site Scripting aligns with the output escaping findings. The fact that the last vulnerability was recent (2025-10-06) suggests ongoing security challenges with this plugin. While the plugin exhibits some good practices like a high percentage of prepared SQL statements and some capability checks, the combination of dangerous functions, insufficient output escaping, unsanitized paths, and a history of unpatched XSS vulnerabilities points to a plugin that requires significant attention to security.

In conclusion, the "cornerstone" v0.8.1 plugin has fundamental security weaknesses in its code that, coupled with its vulnerability history, create a substantial risk. The lack of proper output escaping is a critical vulnerability that could be exploited by attackers. The presence of dangerous functions and unpatched vulnerabilities further exacerbates the risk. Users should exercise extreme caution and prioritize updating or seeking alternative solutions.