CVE-2025-15522: Uncanny Automator Plugin XSS Vulnerability

CVE-2025-15522 Overview

CVE-2025-15522 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Uncanny Automator plugin for WordPress. The flaw resides in the automator_discord_user_mapping shortcode and affects all versions up to and including 6.10.0.2. Insufficient input sanitization and output escaping on the verified_message parameter allow authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts. The injected payload executes whenever a user with a verified Discord account loads the affected page.

Critical Impact
Authenticated Contributor-level attackers can persist JavaScript that executes in the browsers of authenticated visitors with verified Discord accounts, enabling session theft, content manipulation, and privilege escalation chains.

Affected Products

Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin for WordPress
All versions up to and including 6.10.0.2
Discord integration component (discord-user-mapping-shortcode.php)

Discovery Timeline

2026-01-23 - CVE-2025-15522 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-15522

Vulnerability Analysis

The vulnerability resides in the Discord user mapping shortcode handler at src/integrations/discord/shortcodes/discord-user-mapping-shortcode.php. The shortcode accepts a verified_message attribute that is rendered back into page output without proper sanitization or escaping. Any user permitted to author posts containing shortcodes — Contributor and higher — can embed the shortcode with a malicious verified_message value.

The stored payload triggers when a logged-in visitor whose account is linked to a verified Discord identity accesses the page. Because execution occurs in the context of the victim's authenticated WordPress session, an attacker can steal session cookies, perform actions on behalf of the victim, or pivot toward administrator account takeover when an administrator views the content.

Root Cause

The root cause is missing input sanitization and missing output escaping on shortcode attributes. WordPress shortcode attributes must be sanitized on intake (for example via sanitize_text_field) and escaped on output (via esc_html, esc_attr, or wp_kses) depending on rendering context. The vulnerable code path performed neither, allowing raw HTML and JavaScript to pass through to the rendered DOM.

Attack Vector

Exploitation requires an authenticated WordPress account with Contributor privileges or higher. The attacker creates or edits a post containing the automator_discord_user_mapping shortcode with a crafted verified_message value containing JavaScript. Once the post is published, the payload persists in the database and executes against any verified Discord user who loads the page. No additional user interaction beyond viewing the page is required.

For technical details, see the WordPress Plugin Shortcode Code and the WordPress Plugin Change Set that addresses the issue.

Detection Methods for CVE-2025-15522

Indicators of Compromise

Posts or pages containing the automator_discord_user_mapping shortcode with verified_message attributes that include <script>, onerror=, onload=, or javascript: constructs.
Database entries in wp_posts.post_content containing the shortcode alongside HTML event handlers or encoded script payloads.
Outbound browser requests from authenticated sessions to unfamiliar third-party hosts following page loads on Discord-integrated content.

Detection Strategies

Query the WordPress database for shortcode usage: SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%automator_discord_user_mapping%' and review each verified_message attribute.
Inspect web server access logs for Contributor or Author account activity that creates or edits posts containing the affected shortcode.
Deploy Content Security Policy reporting to surface inline script execution on pages rendered by the Uncanny Automator plugin.

Monitoring Recommendations

Audit Contributor, Author, and Editor accounts for unexpected post creation or revision activity in WordPress.
Monitor wp_posts revisions and the audit log for shortcode insertions referencing Discord integrations.
Alert on anomalous administrator session behavior, including unsolicited password resets, user creation, or plugin installation events that may follow XSS-driven session hijack.

How to Mitigate CVE-2025-15522

Immediate Actions Required

Update the Uncanny Automator plugin to a version newer than 6.10.0.2 that includes the fix from changeset 3440408.
Audit all existing posts and pages that use the automator_discord_user_mapping shortcode and remove any suspicious verified_message content.
Review Contributor, Author, and Editor accounts; rotate credentials and remove accounts that should not retain shortcode-capable roles.

Patch Information

The vendor addressed the issue in the WordPress Plugin Change Set 3440408. The latest plugin release is available on the WordPress Uncanny Automator Plugin page. The fix introduces proper sanitization and output escaping on the verified_message parameter. Additional reporting is available in the Wordfence Vulnerability Report.

Workarounds

Temporarily restrict shortcode usage for Contributor and Author roles by removing the unfiltered_html capability and using a plugin that limits shortcode rendering to trusted roles.
Disable the Discord integration within Uncanny Automator until patching is complete to prevent rendering of the vulnerable shortcode.
Apply a Web Application Firewall (WAF) rule that blocks request bodies containing the shortcode name combined with HTML event handlers or <script tokens.

bash

# Identify posts containing the vulnerable shortcode via WP-CLI
wp db query "SELECT ID, post_title, post_author FROM wp_posts WHERE post_content LIKE '%automator_discord_user_mapping%' AND post_status IN ('publish','draft','pending');"

# Update the Uncanny Automator plugin to the patched release
wp plugin update uncanny-automator

# Verify installed version is later than 6.10.0.2
wp plugin get uncanny-automator --field=version