What is the CVSS score of CVE-2025-1794?

CVE-2025-1794 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2025-1794

EUVD-2025-209292 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-08 Wordfence

WordPress XSS

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 08, 2026 - 07:00 euvd

EUVD-2025-209292

Analysis Generated

Apr 08, 2026 - 07:00 vuln.today

CVE Published

Apr 08, 2026 - 06:43 nvd

MEDIUM 5.4

DescriptionCVE.org

The AM LottiePlayer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via uploaded SVG files in all versions up to, and including, 3.6.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in AM LottiePlayer WordPress plugin versions up to 3.6.0 allows authenticated attackers with Author-level privileges or higher to inject malicious scripts via specially crafted SVG file uploads, which execute in the browsers of all users viewing the affected pages. The vulnerability stems from insufficient input sanitization during SVG processing and lack of proper output escaping, enabling persistent payload delivery to website visitors without requiring any user interaction beyond normal page access.

Technical ContextAI

The AM LottiePlayer plugin (CPE: cpe:2.3:a:johanaarstein:am_lottieplayer:*:*:*:*:*:*:*:*) processes uploaded SVG files through its upload-thumbnail.php handler without adequately filtering or validating SVG content before storage and rendering. SVG files are XML-based vector graphics that can embed arbitrary JavaScript code within script tags or event handlers (onclick, onload, etc.), making them a known vector for XSS attacks. The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), which describes the failure to sanitize user-supplied data before it is rendered in HTML context. The plugin fails to implement both input-level sanitization (removing malicious code before storage) and output-level escaping (preventing stored code from executing when rendered), allowing authenticated users to persistently inject scripts that affect all subsequent viewers.

RemediationAI

Update the AM LottiePlayer plugin to a patched version newer than 3.6.0 if available from the official WordPress plugin repository. Immediately review and audit all SVG files uploaded through the LottiePlayer plugin on affected sites for malicious content, particularly checking the page source and browser developer console for unexpected script execution. As an interim mitigation while patches are unavailable or during deployment, restrict Author-level and above user capabilities to use the LottiePlayer upload functionality, or disable the plugin entirely until a confirmed patch is released. Monitor the official plugin page and Wordfence threat intelligence (https://www.wordfence.com/threat-intel/vulnerabilities/id/ef2f1ad1-1e2e-4b56-b16c-d87956b142ad?source=cve) for patch availability announcements.