The Uncanny Automator plugin is vulnerable to a stored cross‑site scripting bug that permits authenticated users with Contributor role or higher to place arbitrary scripts into the verified_message parameter of the automator_discord_user_mapping shortcode. The injected code is rendered whenever a user who owns a verified Discord account visits the page containing the shortcode, potentially allowing session hijacking or credential theft within that user’s browser context. This flaw is a classic CWE‑79 stored XSS and does not grant remote code execution on the server itself, but it enables an attacker to influence the client‑side environment of targeted visitors.

WordPress sites running any version of the Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin up to and including 6.10.0.2. The vulnerability can be exercised only by users who have at least Contributor permissions and are able to access or create pages that use the automator_discord_user_mapping shortcode.

The CVSS score of 6.4 indicates moderate severity, while the EPSS score of less than 1% shows a very low likelihood of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires authenticated access at the Contributor level; an attacker would need to add malicious content to the verified_message parameter and then place the shortcode on a shared page so that a target with a verified Discord account sees the injected script.