CVE-2025-1794 is a stored cross-site scripting vulnerability (CWE-79) in the AM LottiePlayer plugin for WordPress, affecting all versions up to and including 3.6.0. The issue allows authenticated users with Author-level privileges or above to upload SVG files containing malicious scripts. Due to inadequate sanitization and escaping of these SVG files, the injected scripts execute in the context of any user who accesses the compromised page, potentially leading to information disclosure or session hijacking. The CVSS 3.1 base score is 5.4 (medium severity), reflecting network attack vector, low attack complexity, required privileges, and user interaction.

An attacker with Author-level access can inject persistent malicious scripts via SVG uploads, which execute in the browsers of users viewing the infected pages. This can lead to limited confidentiality and integrity impacts such as theft of user session data or manipulation of page content. There is no direct availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — no official fix or patch links are currently available. Users should monitor the vendor's advisory for updates. Until a patch is released, restrict Author-level access to trusted users only and consider disabling SVG uploads if possible to reduce exposure.