CVE-2025-1794: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in johanaarstein AM LottiePlayer
The AM LottiePlayer WordPress plugin up to version 3. 6. 0 contains a stored cross-site scripting (XSS) vulnerability via uploaded SVG files. Authenticated users with Author-level access or higher can inject malicious scripts that execute when other users view the affected pages. This vulnerability arises from insufficient input sanitization and output escaping of SVG content. The CVSS score is 5. 4, indicating a medium severity risk. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
AI Analysis
Technical Summary
CVE-2025-1794 is a stored cross-site scripting vulnerability in the AM LottiePlayer WordPress plugin (versions up to 3.6.0). It allows authenticated users with Author-level privileges or above to upload specially crafted SVG files containing malicious scripts. Due to improper input sanitization and output escaping, these scripts are stored and later executed in the context of users viewing the injected pages. This can lead to limited confidentiality and integrity impacts as indicated by the CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). No official patch or remediation level has been published by the vendor as of the data provided.
Potential Impact
An attacker with Author-level access or higher can inject persistent malicious scripts via SVG uploads, which execute when other users access the compromised pages. This can lead to partial confidentiality and integrity loss, such as session hijacking or content manipulation, but does not affect availability. The vulnerability requires user interaction and authenticated privileges, limiting the attack scope. No known active exploitation has been reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Author-level user capabilities to prevent SVG uploads or disable the AM LottiePlayer plugin if possible. Monitor for plugin updates from the vendor addressing this vulnerability.
CVE-2025-1794: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in johanaarstein AM LottiePlayer
Description
The AM LottiePlayer WordPress plugin up to version 3. 6. 0 contains a stored cross-site scripting (XSS) vulnerability via uploaded SVG files. Authenticated users with Author-level access or higher can inject malicious scripts that execute when other users view the affected pages. This vulnerability arises from insufficient input sanitization and output escaping of SVG content. The CVSS score is 5. 4, indicating a medium severity risk. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2025-1794 is a stored cross-site scripting vulnerability in the AM LottiePlayer WordPress plugin (versions up to 3.6.0). It allows authenticated users with Author-level privileges or above to upload specially crafted SVG files containing malicious scripts. Due to improper input sanitization and output escaping, these scripts are stored and later executed in the context of users viewing the injected pages. This can lead to limited confidentiality and integrity impacts as indicated by the CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). No official patch or remediation level has been published by the vendor as of the data provided.
Potential Impact
An attacker with Author-level access or higher can inject persistent malicious scripts via SVG uploads, which execute when other users access the compromised pages. This can lead to partial confidentiality and integrity loss, such as session hijacking or content manipulation, but does not affect availability. The vulnerability requires user interaction and authenticated privileges, limiting the attack scope. No known active exploitation has been reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Author-level user capabilities to prevent SVG uploads or disable the AM LottiePlayer plugin if possible. Monitor for plugin updates from the vendor addressing this vulnerability.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2025-02-28T18:43:27.517Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69d5fe4c1cc7ad14da373828
Added to database: 4/8/2026, 7:05:48 AM
Last enriched: 4/15/2026, 1:32:30 PM
Last updated: 5/23/2026, 7:28:24 PM
Views: 45
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.