uncannyowl Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin vulnerabilities

18 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 15 published in the last 12 months.

Check whether your uncannyowl Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin version is affected

Latest uncannyowl Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin vulnerabilities

CVE-2026-15025 — Uncanny Automator <= 7.3.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Integration Metadata Disclosure via Multiple AJAX Endpoints (CVSS 7.5)
CVE-2026-65462 — WordPress Uncanny Automator plugin <= 7.3.2 - SQL Injection vulnerability (CVSS 7.6)
CVE-2026-15008 — Uncanny Automator <= 7.3.1.4 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via Forminator Submitted-Field Token (CVSS 8.1)
CVE-2026-56057 — WordPress Uncanny Automator Pro plugin <= 7.3.0.6 - PHP Object Injection vulnerability (CVSS 9.8)
CVE-2026-56031 — WordPress Uncanny Automator plugin <= 7.3.1.2 - PHP Object Injection vulnerability (CVSS 8.1)
CVE-2026-2269 — Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin <= 7.0.0.3 - Authenticated (Administrator+) Server-Side Request Forgery to Arbitrary File Upload (CVSS 7.2)
CVE-2025-15522 — Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin <= 6.10.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4)
CVE-2025-66056 — WordPress Uncanny Automator plugin < 6.10.0 - Sensitive Data Exposure vulnerability (CVSS 4.3)
CVE-2025-58193 — WordPress Uncanny Automator Plugin <= 6.7.0.1 - Broken Access Control Vulnerability (CVSS 4.3)
CVE-2025-48133 — WordPress Uncanny Automator plugin <= 6.4.0.2 - Broken Access Control Vulnerability (CVSS 9.8)
CVE-2025-4520 — Uncanny Automator <= 6.4.0.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update (CVSS 4.3)
CVE-2025-3623 — Uncanny Automator <= 6.4.0.1 - Unauthenticated PHP Object Injection in automator_api_decode_message Function (CVSS 9.1)
CVE-2025-2075 — Uncanny Automator <= 6.3.0.2 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation (CVSS 8.8)
CVE-2024-13838 — Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin <= 6.2 - Authenticated (Admin+) Server-Side Request Forgery via Webhook (CVSS 3.8)
CVE-2024-37119 — WordPress Uncanny Automator Pro plugin < 5.3.0.1 - Unauthenticated License Settings Reset vulnerability (CVSS 9.8)
CVE-2024-37117 — WordPress Uncanny Automator Pro plugin <= 5.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 6.1)
CVE-2024-37118 — WordPress Uncanny Automator Pro plugin <= 5.3 - Cross Site Request Forgery (CSRF) Leading to License Settings Reset vulnerability (CVSS 8.8)
CVE-2023-52151 — WordPress Uncanny Automator Plugin <= 5.1.0.2 is vulnerable to Sensitive Data Exposure (CVSS 5.3)