EUVD-2025-209292Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Primary rating from Vendor (Wordfence) · only source for this CVE.
CVSS VectorVendor: Wordfence
Lifecycle Timeline
3DescriptionCVE.org
The AM LottiePlayer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via uploaded SVG files in all versions up to, and including, 3.6.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored Cross-Site Scripting in AM LottiePlayer WordPress plugin versions up to 3.6.0 allows authenticated attackers with Author-level privileges or higher to inject malicious scripts via specially crafted SVG file uploads, which execute in the browsers of all users viewing the affected pages. The vulnerability stems from insufficient input sanitization during SVG processing and lack of proper output escaping, enabling persistent payload delivery to website visitors without requiring any user interaction beyond normal page access.
Technical ContextAI
The AM LottiePlayer plugin (CPE: cpe:2.3:a:johanaarstein:am_lottieplayer:*:*:*:*:*:*:*:*) processes uploaded SVG files through its upload-thumbnail.php handler without adequately filtering or validating SVG content before storage and rendering. SVG files are XML-based vector graphics that can embed arbitrary JavaScript code within script tags or event handlers (onclick, onload, etc.), making them a known vector for XSS attacks. The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), which describes the failure to sanitize user-supplied data before it is rendered in HTML context. The plugin fails to implement both input-level sanitization (removing malicious code before storage) and output-level escaping (preventing stored code from executing when rendered), allowing authenticated users to persistently inject scripts that affect all subsequent viewers.
RemediationAI
Update the AM LottiePlayer plugin to a patched version newer than 3.6.0 if available from the official WordPress plugin repository. Immediately review and audit all SVG files uploaded through the LottiePlayer plugin on affected sites for malicious content, particularly checking the page source and browser developer console for unexpected script execution. As an interim mitigation while patches are unavailable or during deployment, restrict Author-level and above user capabilities to use the LottiePlayer upload functionality, or disable the plugin entirely until a confirmed patch is released. Monitor the official plugin page and Wordfence threat intelligence (https://www.wordfence.com/threat-intel/vulnerabilities/id/ef2f1ad1-1e2e-4b56-b16c-d87956b142ad?source=cve) for patch availability announcements.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today