Now officially on WordPress.org

CVE Database / CVE-2025-15522

CVE · Medium

CVE-2025-15522 — Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included [uncanny-automator] < 7.0.0

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2025-15522 Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included [uncanny-automator] < 7.0.0 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Medium 6.4 < 7.0.0 7.0.0 2026-01-22 —

CVE-2025-15522

A security flaw exists in WordPress plugins up to version 6.10.0.2 due to inadequate filtering of certain input parameters. Specifically, the "verified_message" parameter is not properly sanitized or escaped when used within the automator_discord_user_mapping shortcode, allowing authenticated users with Contributor-level access and above to embed malicious scripts that will run whenever a user accesses the affected page. This vulnerability can be exploited by attackers who have verified their Discord account.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings