CVE-2025-2579 is a stored cross-site scripting vulnerability in the bplugins Lottie Player WordPress plugin, affecting all versions up to 1.1.8. The issue arises from insufficient sanitization and escaping of input during web page generation related to file uploads. Authenticated attackers with Author-level access or above can inject arbitrary scripts that execute in the context of users viewing the uploaded files, potentially leading to session hijacking or other script-based attacks. The vulnerability has a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, and partial impact on confidentiality and integrity.

Successful exploitation allows authenticated users with Author-level or higher privileges to inject and store malicious scripts via file uploads. These scripts execute in the browsers of users who access the uploaded files, potentially compromising user sessions or data confidentiality and integrity. There is no impact on availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Author-level and higher user permissions to trusted users only and consider disabling file upload features in the plugin if feasible. Monitor for updates from bplugins regarding a security patch.