CVE-2025-15522

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-15522", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-14T15:50:21.489Z", "datePublished": "2026-01-23T04:34:58.155Z", "dateUpdated": "2026-04-08T16:48:47.549Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:48:47.549Z"}, "affected": [{"vendor": "uncannyowl", "product": "Uncanny Automator \u2013 Easy Automation, Integration, Webhooks & Workflow Builder Plugin", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "6.10.0.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Uncanny Automator \u2013 Easy Automation, Integration, Webhooks & Workflow Builder Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the automator_discord_user_mapping shortcode in all versions up to, and including, 6.10.0.2 due to insufficient input sanitization and output escaping on the verified_message parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user with a verified Discord account accesses the injected page."}], "title": "Uncanny Automator \u2013 Easy Automation, Integration, Webhooks & Workflow Builder Plugin <= 6.10.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/41c54e1b-69b9-4594-8f1e-7ef17f120791?source=cve"}, {"url": "https://wordpress.org/plugins/uncanny-automator"}, {"url": "https://plugins.trac.wordpress.org/browser/uncanny-automator/tags/6.10.0.2/src/integrations/discord/shortcodes/discord-user-mapping-shortcode.php#L128"}, {"url": "https://plugins.trac.wordpress.org/changeset/3440408/uncanny-automator/trunk/src/integrations/discord/shortcodes/discord-user-mapping-shortcode.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Djaidja Moundjid"}], "timeline": [{"time": "2026-01-22T16:30:45.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-23T18:46:56.115385Z", "id": "CVE-2025-15522", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-23T18:47:06.284Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-15522", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-23T18:46:56.115385Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-23T18:47:02.573Z"}}], "cna": {"title": "Uncanny Automator \u2013 Easy Automation, Integration, Webhooks & Workflow Builder Plugin <= 6.10.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode", "credits": [{"lang": "en", "type": "finder", "value": "Djaidja Moundjid"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "uncannyowl", "product": "Uncanny Automator \u2013 Easy Automation, Integration, Webhooks & Workflow Builder Plugin", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "6.10.0.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-01-22T16:30:45.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/41c54e1b-69b9-4594-8f1e-7ef17f120791?source=cve"}, {"url": "https://wordpress.org/plugins/uncanny-automator"}, {"url": "https://plugins.trac.wordpress.org/browser/uncanny-automator/tags/6.10.0.2/src/integrations/discord/shortcodes/discord-user-mapping-shortcode.php#L128"}, {"url": "https://plugins.trac.wordpress.org/changeset/3440408/uncanny-automator/trunk/src/integrations/discord/shortcodes/discord-user-mapping-shortcode.php"}], "descriptions": [{"lang": "en", "value": "The Uncanny Automator \u2013 Easy Automation, Integration, Webhooks & Workflow Builder Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the automator_discord_user_mapping shortcode in all versions up to, and including, 6.10.0.2 due to insufficient input sanitization and output escaping on the verified_message parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user with a verified Discord account accesses the injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-01-23T04:34:58.155Z"}}}, "cveMetadata": {"cveId": "CVE-2025-15522", "state": "PUBLISHED", "dateUpdated": "2026-01-23T18:47:06.284Z", "dateReserved": "2026-01-14T15:50:21.489Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-23T04:34:58.155Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Uncanny Automator \u2013 Easy Automation, Integration, Webhooks & Workflow Builder Plugin", "vendor": "uncannyowl", "versions": [{"lessThanOrEqual": "6.10.0.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Uncanny Automator \u2013 Easy Automation, Integration, Webhooks & Workflow Builder Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the automator_discord_user_mapping shortcode in all versions up to, and including, 6.10.0.2 due to insufficient input sanitization and output escaping on the verified_message parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user with a verified Discord account accesses the injected page."}, {"lang": "es", "value": "El plugin The Uncanny Automator \u2013 Easy Automation, Integration, Webhooks &amp; Workflow Builder Plugin para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s del shortcode automator_discord_user_mapping en todas las versiones hasta la, e incluyendo, 6.10.0.2 debido a una sanitizaci\u00f3n de entrada y escape de salida insuficientes en el par\u00e1metro verified_message. Esto permite que atacantes autenticados, con acceso de nivel Colaborador y superior, inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario con una cuenta de Discord verificada acceda a la p\u00e1gina inyectada."}], "id": "CVE-2025-15522", "lastModified": "2026-06-17T08:37:56.950", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-15522", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-23T18:46:56.115385Z", "version": "2.0.3"}}]}, "published": "2026-01-23T05:16:21.043", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/uncanny-automator/tags/6.10.0.2/src/integrations/discord/shortcodes/discord-user-mapping-shortcode.php#L128"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3440408/uncanny-automator/trunk/src/integrations/discord/shortcodes/discord-user-mapping-shortcode.php"}, {"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/uncanny-automator"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/41c54e1b-69b9-4594-8f1e-7ef17f120791?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T16:14:24.988465+00:00", "value": {"mitigation_remediation": ["Upgrade the Uncanny Automator plugin to version 6.10.0.3 or newer to apply the vendor fix.", "If the upgrade cannot be performed immediately, disable or remove the automator_discord_user_mapping shortcode from all pages and restrict its use to only administrators or higher roles.", "Audit existing content for injected scripts and purge any malicious entries before allowing contributors to publish new versions of the shortcode."], "summary": {"action": "Patch", "impact": "Stored Cross\u2011Site Scripting via a shortcode allowing script injection into pages viewed by users with a verified Discord account"}, "threat_synthesis": {"affected_systems": "WordPress sites running any version of the Uncanny Automator \u2013 Easy Automation, Integration, Webhooks & Workflow Builder Plugin up to and including 6.10.0.2. The vulnerability can be exercised only by users who have at least Contributor permissions and are able to access or create pages that use the automator_discord_user_mapping shortcode.", "description_and_impact": "The Uncanny Automator plugin is vulnerable to a stored cross\u2011site scripting bug that permits authenticated users with Contributor role or higher to place arbitrary scripts into the verified_message parameter of the automator_discord_user_mapping shortcode. The injected code is rendered whenever a user who owns a verified Discord account visits the page containing the shortcode, potentially allowing session hijacking or credential theft within that user\u2019s browser context. This flaw is a classic CWE\u201179 stored XSS and does not grant remote code execution on the server itself, but it enables an attacker to influence the client\u2011side environment of targeted visitors.", "risk_and_exploitability": "The CVSS score of 6.4 indicates moderate severity, while the EPSS score of less than 1% shows a very low likelihood of exploitation at present. The vulnerability is not listed in CISA\u2019s KEV catalog. Exploitation requires authenticated access at the Contributor level; an attacker would need to add malicious content to the verified_message parameter and then place the shortcode on a shared page so that a target with a verified Discord account sees the injected script."}}}}, "created": "2026-01-23T10:26:50.611389+00:00", "updated": "2026-04-21T16:15:40.508815+00:00", "vendors": ["uncannyowl", "uncannyowl$PRODUCT$uncanny_automator", "wordpress", "wordpress$PRODUCT$wordpress"], "weaknesses": ["CWE-79"]}