CVE-2025-15522: Uncanny Automator Plugin XSS Vulnerability

CVE-2025-15522 Overview

A Stored Cross-Site Scripting (XSS) vulnerability has been identified in the Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin for WordPress. The vulnerability exists in the automator_discord_user_mapping shortcode functionality, specifically affecting versions up to and including 6.10.0.2. Due to insufficient input sanitization and output escaping on the verified_message parameter, authenticated attackers with Contributor-level access or above can inject arbitrary web scripts into pages. These malicious scripts execute whenever a user with a verified Discord account accesses the compromised page.

Critical Impact

Authenticated attackers can inject persistent malicious scripts that target users with verified Discord accounts, potentially leading to session hijacking, credential theft, or further compromise of WordPress administrator accounts.

Affected Products

• Uncanny Automator WordPress Plugin versions ≤ 6.10.0.2
• WordPress installations using affected plugin versions with Discord integration enabled
• Sites utilizing the automator_discord_user_mapping shortcode functionality

Discovery Timeline

• 2026-01-23 - CVE-2025-15522 published to NVD
• 2026-01-26 - Last updated in NVD database

Technical Details for CVE-2025-15522

Vulnerability Analysis

This Stored Cross-Site Scripting vulnerability stems from improper handling of user-controlled input within the Discord integration shortcode handler. The vulnerable code resides in discord-user-mapping-shortcode.php, where the verified_message parameter is processed without adequate sanitization before being rendered to the page output. When a Contributor or higher-privileged user creates or edits a page containing the automator_discord_user_mapping shortcode, they can embed malicious JavaScript code within the verified_message parameter that persists in the database and executes in the browsers of visitors who have verified Discord accounts.

The attack requires the victim to have an authenticated Discord account linked through the plugin's mapping feature. This conditional execution adds a layer of targeting, meaning attackers can specifically focus on users who have completed the Discord verification process—often including site administrators and privileged community members.

Root Cause

The vulnerability originates from missing input sanitization and output escaping functions on the verified_message parameter within the shortcode processing logic. WordPress provides built-in sanitization functions such as esc_html(), esc_attr(), and wp_kses() that should be applied to user-controlled content before rendering. The affected code at line 128 of the shortcode handler fails to properly escape this parameter, allowing HTML and JavaScript injection.

Attack Vector

The attack requires network access and low-privileged authentication (Contributor role). An attacker would:

1. Obtain Contributor-level access to the target WordPress site
2. Create or edit a post/page containing the automator_discord_user_mapping shortcode
3. Inject malicious JavaScript within the verified_message parameter
4. Publish or submit the content for review
5. Wait for users with verified Discord accounts to visit the page

The stored nature of this XSS means the payload persists in the WordPress database and executes each time a qualifying user views the affected page. The attack does not require user interaction beyond visiting the page, and the payload executes within the victim's authenticated session context.

The vulnerable shortcode implementation can be reviewed in the WordPress Plugin File, which shows how the verified_message parameter is processed without proper escaping before output rendering.

Detection Methods for CVE-2025-15522

Indicators of Compromise

• Unusual JavaScript code within WordPress post content containing automator_discord_user_mapping shortcode
• Unexpected verified_message parameter values containing script tags, event handlers, or encoded JavaScript
• Reports of unexpected redirects or popup behavior from users with verified Discord accounts
• Browser console errors indicating blocked cross-origin requests from injected payloads

Detection Strategies

• Review WordPress posts and pages for automator_discord_user_mapping shortcode usage with suspicious parameter content
• Implement Web Application Firewall (WAF) rules to detect XSS patterns in shortcode parameters
• Monitor WordPress audit logs for Contributor-level users modifying pages with Discord integration shortcodes
• Deploy Content Security Policy (CSP) headers to detect and block inline script execution attempts

Monitoring Recommendations

• Enable WordPress activity logging to track shortcode modifications by non-administrator users
• Configure SentinelOne Singularity to monitor for suspicious JavaScript execution patterns on WordPress endpoints
• Implement real-time alerting for changes to pages containing Discord integration shortcodes
• Review user access patterns for anomalies in Contributor-level account activity

How to Mitigate CVE-2025-15522

Immediate Actions Required

• Update Uncanny Automator plugin to the latest patched version immediately
• Audit existing pages containing automator_discord_user_mapping shortcode for malicious content
• Restrict Contributor-level access permissions until patch is applied
• Review WordPress user accounts for unauthorized Contributor-level access

Patch Information

The vendor has released a security patch addressing this vulnerability. The fix implements proper output escaping on the verified_message parameter within the shortcode handler. The patch changeset can be reviewed at the WordPress Changeset for Plugin. Additional vulnerability details are available in the Wordfence Vulnerability Report.

Workarounds

• Temporarily disable or remove the Uncanny Automator plugin until patched version is deployed
• Remove all uses of the automator_discord_user_mapping shortcode from site content
• Implement a Web Application Firewall rule to filter requests containing suspicious verified_message parameter values
• Revoke Contributor-level access for untrusted users until vulnerability is remediated

# Configuration example
# Temporarily disable the vulnerable shortcode via wp-config.php
# Add to wp-config.php to prevent shortcode execution
add_shortcode('automator_discord_user_mapping', '__return_empty_string');

# Alternatively, use WP-CLI to deactivate the plugin
wp plugin deactivate uncanny-automator --allow-root