EUVD-2025-209292
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
3Description
The AM LottiePlayer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via uploaded SVG files in all versions up to, and including, 3.6.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Analysis
Stored Cross-Site Scripting in AM LottiePlayer WordPress plugin versions up to 3.6.0 allows authenticated attackers with Author-level privileges or higher to inject malicious scripts via specially crafted SVG file uploads, which execute in the browsers of all users viewing the affected pages. The vulnerability stems from insufficient input sanitization during SVG processing and lack of proper output escaping, enabling persistent payload delivery to website visitors without requiring any user interaction beyond normal page access.
Technical Context
The AM LottiePlayer plugin (CPE: cpe:2.3:a:johanaarstein:am_lottieplayer:*:*:*:*:*:*:*:*) processes uploaded SVG files through its upload-thumbnail.php handler without adequately filtering or validating SVG content before storage and rendering. SVG files are XML-based vector graphics that can embed arbitrary JavaScript code within script tags or event handlers (onclick, onload, etc.), making them a known vector for XSS attacks. The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), which describes the failure to sanitize user-supplied data before it is rendered in HTML context. The plugin fails to implement both input-level sanitization (removing malicious code before storage) and output-level escaping (preventing stored code from executing when rendered), allowing authenticated users to persistently inject scripts that affect all subsequent viewers.
Affected Products
The AM LottiePlayer plugin for WordPress, versions up to and including 3.6.0, is affected across all installations. The plugin is maintained by johanaarstein (CPE identifier cpe:2.3:a:johanaarstein:am_lottieplayer:*:*:*:*:*:*:*:*). Vulnerability details and technical evidence are documented in the Wordfence threat intelligence report (https://www.wordfence.com/threat-intel/vulnerabilities/id/ef2f1ad1-1e2e-4b56-b16c-d87956b142ad?source=cve) and the vulnerable code path is visible in the plugin repository at https://plugins.trac.wordpress.org/browser/am-lottieplayer/tags/3.5.0/includes/upload-thumbnail.php.
Remediation
Update the AM LottiePlayer plugin to a patched version newer than 3.6.0 if available from the official WordPress plugin repository. Immediately review and audit all SVG files uploaded through the LottiePlayer plugin on affected sites for malicious content, particularly checking the page source and browser developer console for unexpected script execution. As an interim mitigation while patches are unavailable or during deployment, restrict Author-level and above user capabilities to use the LottiePlayer upload functionality, or disable the plugin entirely until a confirmed patch is released. Monitor the official plugin page and Wordfence threat intelligence (https://www.wordfence.com/threat-intel/vulnerabilities/id/ef2f1ad1-1e2e-4b56-b16c-d87956b142ad?source=cve) for patch availability announcements.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today