Analysis Report · Folder Analysis cache/uncanny-automator_6.10.0.2 → cache/uncanny-automator_7.0.0 — CVE-2025-15522

--- cache/uncanny-automator_6.10.0.2/src/core/classes/class-background-actions.php	2026-01-25 00:16:18.556155132 +0000+++ cache/uncanny-automator_7.0.0/src/core/classes/class-background-actions.php	2026-01-25 00:18:05.522773636 +0000@@ -358,6 +358,7 @@ 	public function test_endpoint( $value ) {  		if ( empty( $value ) ) {+			automator_update_option( self::OPTION_NAME, '0' ); 			return '0'; 		} @@ -377,6 +378,7 @@ 		$error = $this->rest_api_error();  		if ( null === $error || empty( $error ) ) {+			automator_update_option( self::OPTION_NAME, '1' ); 			return '1'; 		} @@ -384,6 +386,7 @@ 			add_settings_error( self::OPTION_NAME, self::OPTION_NAME, $error, 'error' ); 		} +		automator_update_option( self::OPTION_NAME, '0' ); 		return '0'; 	} 

Based on my analysis of the code diff, here are my findings:

---

**Vulnerability 1:**

Vulnerability Existed: no

Improper State Persistence - CWE-400 (Uncontrolled Resource Consumption) / CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization) - src/core/classes/class-background-actions.php Lines 361, 381, 389

Old Code:
```php
if ( empty( $value ) ) {
    return '0';
}
...
if ( null === $error || empty( $error ) ) {
    return '1';
}
...
return '0';
```

Fixed Code:
```php
if ( empty( $value ) ) {
    automator_update_option( self::OPTION_NAME, '0' );
    return '0';
}
...
if ( null === $error || empty( $error ) ) {
    automator_update_option( self::OPTION_NAME, '1' );
    return '1';
}
...
automator_update_option( self::OPTION_NAME, '0' );
return '0';
```

Explanation:
This is NOT a security vulnerability fix, but rather a state management improvement. The changes add persistent option updates to the WordPress database via `automator_update_option()` calls that correspond to the return values. Previously, the function returned status values (0 or 1) without persisting the state, which could lead to inconsistent state between the function's return value and the stored option. The fix ensures state consistency by always persisting the endpoint test result. This improves reliability and prevents race conditions where the option value may differ from the actual endpoint status. No security vulnerability exists in the original code, but this is a defensive programming practice to maintain data consistency.

The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the automator_discord_user_mapping shortcode in all versions up to, and including, 6.10.0.2 due to insufficient input sanitization and output escaping on the verified_message parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user with a verified Discord account accesses the injected page.

--- cache/uncanny-automator_6.10.0.2/src/integrations/bluesky/helpers/bluesky-post-record.php	2026-01-25 00:16:18.604158102 +0000+++ cache/uncanny-automator_7.0.0/src/integrations/bluesky/helpers/bluesky-post-record.php	2026-01-25 00:18:05.566776359 +0000@@ -70,7 +70,7 @@ 	 * @param array $media - The media of the post. 	 */ 	public function __construct( $text, $media = array() ) {-		$this->text  = sanitize_textarea_field( $text );+		$this->text  = $text; 		$this->media = $media; 	} 

I'll analyze this code diff for security vulnerabilities.

Vulnerability Existed: yes
FALSE POSITIVE

Cross-Site Scripting (XSS) - CWE-79 - src/integrations/bluesky/helpers/bluesky-post-record.php Lines 73

Old Code:
```php
$this->text  = sanitize_textarea_field( $text );
```

Fixed Code:
```php
$this->text  = $text;
```

Explanation:
This change removes the security fix rather than applying one. The original code used `sanitize_textarea_field()`, a WordPress sanitization function that strips potentially dangerous HTML and script tags from user input. The new code removes this sanitization entirely, storing the raw `$text` parameter without any processing. If this text is later output to the frontend without proper escaping (e.g., using `esc_html()` or `esc_attr()`), it creates a Cross-Site Scripting (XSS) vulnerability. An attacker could inject malicious JavaScript code through the `$text` parameter that would execute in users' browsers. This is a regression—the code is becoming less secure, not more secure.

The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the automator_discord_user_mapping shortcode in all versions up to, and including, 6.10.0.2 due to insufficient input sanitization and output escaping on the verified_message parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user with a verified Discord account accesses the injected page.

--- cache/uncanny-automator_6.10.0.2/src/integrations/discord/shortcodes/discord-user-mapping-shortcode.php	2026-01-25 00:16:18.620159092 +0000+++ cache/uncanny-automator_7.0.0/src/integrations/discord/shortcodes/discord-user-mapping-shortcode.php	2026-01-25 00:18:05.582777349 +0000@@ -125,7 +125,7 @@ 		if ( $this->helpers->get_mapped_wp_user_discord_id( $current_user->ID ) ) { 			return sprintf( 				'<div class="uap-discord-connected">%s</div>',-				$atts['verified_message']+				esc_html( $atts['verified_message'] ) 			); 		} 

Vulnerability Existed: yes
TRUE POSITIVE
Cross-Site Scripting (XSS) - CWE-79 - src/integrations/discord/shortcodes/discord-user-mapping-shortcode.php - Line 128

Old Code:
```php
'<div class="uap-discord-connected">%s</div>',
$atts['verified_message']
```

Fixed Code:
```php
'<div class="uap-discord-connected">%s</div>',
esc_html( $atts['verified_message'] )
```

Explanation:
The original code directly outputs `$atts['verified_message']` into the HTML without sanitization. Since `$atts` comes from shortcode attributes (user-controllable input), an attacker could inject malicious JavaScript by including script tags or event handlers in the verified_message attribute. The fix applies `esc_html()` to escape HTML special characters, preventing the injected code from being interpreted as executable JavaScript. This is a proper remediation for stored/reflected XSS vulnerabilities in WordPress contexts.

The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the automator_discord_user_mapping shortcode in all versions up to, and including, 6.10.0.2 due to insufficient input sanitization and output escaping on the verified_message parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user with a verified Discord account accesses the injected page.

--- cache/uncanny-automator_6.10.0.2/src/integrations/wp-job-manager/helpers/wpjm-helpers.php	2026-01-25 00:16:18.732166023 +0000+++ cache/uncanny-automator_7.0.0/src/integrations/wp-job-manager/helpers/wpjm-helpers.php	2026-01-25 00:18:05.690784031 +0000@@ -1,25 +1,16 @@ <?php +namespace Uncanny_Automator\Integrations\Wpjm; -namespace Uncanny_Automator;--use Uncanny_Automator_Pro\Wpjm_Pro_Helpers;+// Backwards compatibility for old helper classes.+class_alias( 'Uncanny_Automator\Integrations\Wpjm\Wpjm_Helpers', 'Uncanny_Automator\Wpjm_Helpers' );  /**  * Class Wpjm_Helpers  *- * @package Uncanny_Automator+ * @package Uncanny_Automator\Integrations\Wpjm  */ class Wpjm_Helpers {-	/**-	 * @var Wpjm_Helpers-	 */-	public $options;--	/**-	 * @var Wpjm_Pro_Helpers-	 */-	public $pro;  	/** 	 * @var bool@@ -30,51 +21,24 @@ 	 * Wpjm_Helpers constructor. 	 */ 	public function __construct() {--	}--	/**-	 * @param Wpjm_Helpers $options-	 */-	public function setOptions( Wpjm_Helpers $options ) {-		$this->options = $options;-	}--	/**-	 * @param Wpjm_Pro_Helpers $pro-	 */-	public function setPro( Wpjm_Pro_Helpers $pro ) {-		$this->pro = $pro;+		// Constructor can be empty in new framework 	}  	/**-	 * @param string $label-	 * @param string $option_code-	 * @param array $args+	 * Get job types options 	 *-	 * @return mixed+	 * @return array 	 */+	public function list_wpjm_job_types() {+		$options = array(); -	public function list_wpjm_job_types( $label = null, $option_code = 'WPJMJOBTYPE', $args = array() ) {-		if ( ! $this->load_options ) {--			return Automator()->helpers->recipe->build_default_options_array( $label, $option_code );-		}--		if ( ! $label ) {-			$label = esc_attr__( 'Job type', 'uncanny-automator' );-		}--		$token        = key_exists( 'token', $args ) ? $args['token'] : false;-		$is_ajax      = key_exists( 'is_ajax', $args ) ? $args['is_ajax'] : false;-		$target_field = key_exists( 'target_field', $args ) ? $args['target_field'] : '';-		$end_point    = key_exists( 'endpoint', $args ) ? $args['endpoint'] : '';-		$options      = array();--		$options['-1'] = esc_html__( 'Any type', 'uncanny-automator' );+		$options[] = array(+			'text' => esc_html_x( 'Any type', 'WP Job Manager', 'uncanny-automator' ),+			'value' => '-1',+		);  		if ( Automator()->helpers->recipe->load_helpers ) {-			// WP Job Manager is hidding terms on non job template+			// WP Job Manager is hiding terms on non job template 			$terms = get_terms( 				array( 					'taxonomy'   => 'job_listing_type',@@ -85,59 +49,36 @@ 			if ( ! is_wp_error( $terms ) ) { 				if ( ! empty( $terms ) ) { 					foreach ( $terms as $term ) {-						$options[ $term->term_id ] = esc_html( $term->name );+						$options[] = array(+							'text' => esc_html( $term->name ),+							'value' => (string) $term->term_id,+						); 					} 				} 			} 		}-		$type = 'select';--		$option = array(-			'option_code'     => $option_code,-			'label'           => $label,-			'input_type'      => $type,-			'required'        => true,-			'supports_tokens' => $token,-			'is_ajax'         => $is_ajax,-			'fill_values_in'  => $target_field,-			'endpoint'        => $end_point,-			'options'         => $options,-		); -		return apply_filters( 'uap_option_list_wpjm_job_types', $option );+		return $options; 	}  	/**-	 * @param string $label-	 * @param string $option_code-	 * @param array $args+	 * Get jobs options 	 *-	 * @return mixed+	 * @return array 	 */+	public function list_wpjm_jobs() {+		$options = array(); -	public function list_wpjm_jobs( $label = null, $option_code = 'WPJMJOBS', $args = array() ) {-		if ( ! $this->load_options ) {--			return Automator()->helpers->recipe->build_default_options_array( $label, $option_code );-		}--		if ( ! $label ) {-			$label = esc_attr__( 'Job', 'uncanny-automator' );-		}--		$token        = key_exists( 'token', $args ) ? $args['token'] : false;-		$is_ajax      = key_exists( 'is_ajax', $args ) ? $args['is_ajax'] : false;-		$target_field = key_exists( 'target_field', $args ) ? $args['target_field'] : '';-		$end_point    = key_exists( 'endpoint', $args ) ? $args['endpoint'] : '';-		$options      = array();--		$options['-1'] = esc_html__( 'Any job', 'uncanny-automator' );+		$options[] = array(+			'text' => esc_html_x( 'Any job', 'WP Job Manager', 'uncanny-automator' ),+			'value' => '-1',+		);  		if ( Automator()->helpers->recipe->load_helpers ) {-			// WP Job Manager is hidding terms on non job template+			// WP Job Manager is hiding terms on non job template 			$args = array( 				'post_type'      => 'job_listing',-				'posts_per_page' => 9999,+				'posts_per_page' => 9999, //phpcs:ignore WordPress.WP.PostsPerPage.posts_per_page_posts_per_page 				'orderby'        => 'title', 				'order'          => 'ASC', 				'post_status'    => 'publish',@@ -146,58 +87,15 @@ 			if ( ! is_wp_error( $jobs ) ) { 				if ( ! empty( $jobs ) ) { 					foreach ( $jobs as $job ) {-						$options[ $job->ID ] = esc_html( $job->post_title );+						$options[] = array(+							'text' => esc_html( $job->post_title ),+							'value' => (string) $job->ID,+						); 					} 				} 			} 		}-		$type = 'select';--		$option = array(-			'option_code'     => $option_code,-			'label'           => $label,-			'input_type'      => $type,-			'required'        => true,-			'supports_tokens' => $token,-			'is_ajax'         => $is_ajax,-			'fill_values_in'  => $target_field,-			'endpoint'        => $end_point,-			'options'         => $options,-			'relevant_tokens' => array(-				$option_code         => esc_html__( 'Job title', 'uncanny-automator' ),-				$option_code . '_ID' => esc_html__( 'Job ID', 'uncanny-automator' ),-			),-		);--		return apply_filters( 'uap_option_list_wpjm_jobs', $option );-	}--	/**-	 * Returns an array collection of categories in Job.-	 *-	 * @return array $terms The collection of terms.-	 */-	public function get_resume_categories( $resume_id = 0 ) {--		if ( empty( $resume_id ) ) {-			return array();-		}--		$categories = array();--		$terms = wp_get_object_terms( $resume_id, 'resume_category' );--		if ( ! is_wp_error( $terms ) ) {-			if ( ! empty( $terms ) ) {-				foreach ( $terms as $term ) {-					$categories[] = $term->name;-				}-				// Sort alphabetically.-				sort( $categories );-			}-		}--		return $categories; +		return $options; 	} }

I'll analyze this diff for security vulnerabilities.

**Vulnerability Existed: no**

**No CWE Violations - Security Improvements Made**

The code changes represent a refactoring and modernization of the helper class, with several security-conscious improvements:

**Analysis:**

1. **Removed Deprecated Dependencies** (Lines 1-6)
   - Old Code: `use Uncanny_Automator_Pro\Wpjm_Pro_Helpers;`
   - Fixed Code: Removed unnecessary dependencies; backwards compatibility via `class_alias`
   - Explanation: Eliminating unused dependencies reduces attack surface and potential vulnerabilities in unused code paths.

2. **Removed Unnecessary Properties** (Lines 8-17)
   - Old Code: `public $options;` and `public $pro;` public properties
   - Fixed Code: Removed entirely
   - Explanation: Removing public properties reduces unintended data exposure and simplifies the class interface.

3. **Simplified Method Signatures** (Lines 47-100)
   - Old Code: Methods accepted user-controlled `$args` array with keys like `'endpoint'` and `'token'` passed to `apply_filters()`
   - Fixed Code: Methods now return simple option arrays without filter parameters
   - Explanation: The old implementation passed user-controlled arguments through filters, creating potential injection vectors. New code eliminates this by returning standardized data structures.

4. **Improved Data Encoding** (Lines 53-58, 79-85)
   - Old Code: `$options[ $term->term_id ] = esc_html( $term->name );` (associative array with potential ID collision)
   - Fixed Code: `'value' => (string) $term->term_id` with explicit type casting
   - Explanation: Explicit type casting prevents type juggling vulnerabilities and ensures consistent data types.

5. **PHPCS Compliance** (Line 97)
   - Added: `//phpcs:ignore WordPress.WP.PostsPerPage.posts_per_page_posts_per_page`
   - Explanation: Acknowledges the large posts_per_page value with documented exception rather than leaving it unreviewed.

6. **Removed Unused Method** (Lines 149-165)
   - Removed: `get_resume_categories()` method that was not being utilized
   - Explanation: Removes dead code that could contain undiscovered vulnerabilities and reduces maintenance burden.

**Conclusion:** This refactoring improves security posture by eliminating unnecessary data flows, reducing public API surface, removing unused code, and standardizing data structures.

The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the automator_discord_user_mapping shortcode in all versions up to, and including, 6.10.0.2 due to insufficient input sanitization and output escaping on the verified_message parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user with a verified Discord account accesses the injected page.