Uncannyowl Uncanny Automator
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Uncannyowl Uncanny Automator.
By the Year
In 2026 there have been 0 vulnerabilities in Uncannyowl Uncanny Automator. Last year, in 2025 Uncanny Automator had 6 security vulnerabilities published. Right now, Uncanny Automator is on track to have less security vulnerabilities in 2026 than it did last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 0 | 0.00 |
| 2025 | 6 | 6.97 |
| 2024 | 4 | 7.50 |
It may take a day or so for new Uncanny Automator vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Uncannyowl Uncanny Automator Security Vulnerabilities
Unauth Control Sphere: Sensitive Data Exposure in Uncanny Automator <6.10.0
CVE-2025-66056
4.3 - Medium
- November 21, 2025
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Uncanny Owl Uncanny Automator uncanny-automator allows Retrieve Embedded Sensitive Data.This issue affects Uncanny Automator: from n/a through < 6.10.0.
Exposure of Sensitive System Information to an Unauthorized Control Sphere
Uncanny Automator v6.4.0.2: Missing Auth Exploiting Access Control
CVE-2025-48133
9.8 - Critical
- June 05, 2025
Missing Authorization vulnerability in Uncanny Owl Uncanny Automator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Uncanny Automator: from n/a through 6.4.0.2.
AuthZ
Unauth Data Mod in Uncanny Automator WP Plugin <=6.4.0.2 via Missing Cap Check
CVE-2025-4520
4.3 - Medium
- May 14, 2025
The Uncanny Automator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX functions in versions up to, and including, 6.4.0.2. This makes it possible for authenticated attackers, with subscriber-level permissions or above to update plugin settings.
AuthZ
Uncanny Automator PHP Object Injection v<=6.4.0.1 via automator_api_decode_message()
CVE-2025-3623
9.1 - Critical
- May 14, 2025
The Uncanny Automator plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.4.0.1 via deserialization of untrusted input in the automator_api_decode_message() function. This makes it possible for unauthenticated to inject a PHP Object. The additional presence of a POP chain allows attackers to delete arbitrary files.
Marshaling, Unmarshaling
Uncanny Automator WP Plugin v6.3.0.2 – Auth Priv Esc via role() w/o checks
CVE-2025-2075
8.8 - High
- April 04, 2025
The Uncanny Automator Easy Automation, Integration, Webhooks & Workflow Builder Plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.0.2. This is due to add_role() and user_role() functions missing proper capability checks performed through the validate_rest_call() function. This makes it possible for unauthenticated attackers to set the role of arbitrary users to administrator granting full access to the site, though privilege escalation requires an active account on the site so this is considered an authenticated privilege escalation.
AuthZ
Uncanny Automator <=6.2 SSRF via call_webhook Admin
CVE-2024-13838
5.5 - Medium
- March 12, 2025
The Uncanny Automator Easy Automation, Integration, Webhooks & Workflow Builder Plugin plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.2 via the 'call_webhook' method of the Automator_Send_Webhook class This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
SSRF
Uncanny Automator Pro Missing Auth Vulnerability Before 5.3.0.0
CVE-2024-37119
9.8 - Critical
- November 01, 2024
Missing Authorization vulnerability in Uncanny Owl Uncanny Automator Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Uncanny Automator Pro: from n/a through 5.3.0.0.
AuthZ
Uncanny Automator Pro <=5.3 Reflected XSS Vulnerability
CVE-2024-37117
6.1 - Medium
- July 22, 2024
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Uncanny Owl Uncanny Automator Pro allows Reflected XSS.This issue affects Uncanny Automator Pro: from n/a through 5.3.
XSS
CSRF Vulnerability in Uncanny Automator Pro <=5.3
CVE-2024-37118
8.8 - High
- June 21, 2024
Cross Site Request Forgery (CSRF) vulnerability in Uncanny Owl Uncanny Automator Pro.This issue affects Uncanny Automator Pro: from n/a through 5.3.
Session Riding
Uncanny Automator <=5.1.0.2 Info Disclosure to Unauthorized Actor
CVE-2023-52151
5.3 - Medium
- January 05, 2024
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Uncanny Automator, Uncanny Owl Uncanny Automator Automate everything with the #1 no-code automation and integration plugin.This issue affects Uncanny Automator Automate everything with the #1 no-code automation and integration plugin: from n/a through 5.1.0.2.
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Uncannyowl Uncanny Automator or by Uncannyowl? Click the Watch button to subscribe.
