CVE-2025-1794: AM LottiePlayer WordPress XSS Vulnerability

CVE-2025-1794 Overview

The AM LottiePlayer plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in all versions up to and including 3.6.0. The vulnerability exists due to insufficient input sanitization and output escaping when handling uploaded SVG files. This security flaw allows authenticated attackers with Author-level access or above to inject arbitrary web scripts into WordPress pages, which execute whenever a user accesses the compromised page.

Critical Impact

Authenticated attackers can achieve persistent script injection through malicious SVG uploads, potentially leading to session hijacking, credential theft, website defacement, or distribution of malware to site visitors.

Affected Products

• AM LottiePlayer plugin for WordPress version 3.6.0 and earlier
• WordPress installations with AM LottiePlayer plugin allowing Author-level uploads
• Any website allowing SVG file uploads through the vulnerable plugin

Discovery Timeline

• 2026-04-08 - CVE CVE-2025-1794 published to NVD
• 2026-04-08 - Last updated in NVD database

Technical Details for CVE-2025-1794

Vulnerability Analysis

This Stored Cross-Site Scripting vulnerability stems from the plugin's failure to properly sanitize SVG file content during the upload process. SVG files are XML-based vector graphics that can contain embedded JavaScript code within <script> tags or event handlers. When the AM LottiePlayer plugin processes these uploads without adequate input validation, malicious scripts embedded in SVG files persist in the WordPress database and execute in the browsers of users viewing the affected pages.

The vulnerability specifically affects the thumbnail upload functionality within the plugin. Because the injected scripts are stored server-side, every visitor to the compromised page becomes a potential victim, making this significantly more dangerous than reflected XSS attacks. The attack requires authentication with at least Author-level privileges, which limits the initial attack surface but still represents a significant risk in multi-author WordPress environments.

Root Cause

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The upload-thumbnail.php file in the AM LottiePlayer plugin fails to implement proper input sanitization when processing uploaded SVG files. The plugin does not strip or escape potentially dangerous SVG elements such as <script> tags, onload event handlers, onclick attributes, or other JavaScript execution vectors before storing the content or rendering it to users.

Attack Vector

The attack leverages the network-accessible file upload functionality of WordPress combined with the plugin's insufficient validation. An attacker with Author credentials can craft a malicious SVG file containing embedded JavaScript payloads. When uploaded through the AM LottiePlayer interface, the malicious content is stored and subsequently rendered without proper escaping. The attack requires user interaction—specifically, a victim must view a page containing the malicious SVG—to trigger script execution.

The vulnerability is particularly concerning because SVG files are often trusted as "safe" image formats, and many WordPress security configurations may not specifically block or sanitize SVG uploads. Once the malicious SVG is uploaded and embedded in a page or post, the injected scripts execute with the same privileges as the victim's browser session.

Detection Methods for CVE-2025-1794

Indicators of Compromise

• Presence of SVG files with embedded <script> tags or JavaScript event handlers in WordPress uploads
• Unexpected or obfuscated JavaScript code within SVG file contents in the wp-content/uploads directory
• User reports of unexpected browser behavior or redirects when viewing specific pages
• New or modified SVG files uploaded by Author-level accounts that contain suspicious XML structures

Detection Strategies

• Implement file content scanning to detect JavaScript code embedded within SVG uploads
• Monitor WordPress upload directories for SVG files containing potentially malicious elements such as <script>, onload, onerror, or javascript: URI schemes
• Review WordPress user activity logs for unusual file upload patterns from Author-level accounts
• Use Web Application Firewalls (WAF) with rules to detect XSS payloads in uploaded file content

Monitoring Recommendations

• Enable WordPress audit logging to track all file uploads and modifications by authenticated users
• Configure server-side logging to capture requests to the upload-thumbnail.php endpoint
• Implement real-time alerting for SVG file uploads containing script-related keywords or suspicious patterns
• Monitor for unusual HTTP referrer patterns that may indicate exploitation attempts

How to Mitigate CVE-2025-1794

Immediate Actions Required

• Update AM LottiePlayer plugin to a patched version as soon as one becomes available from the vendor
• Audit existing SVG uploads for malicious content and remove any compromised files
• Temporarily disable SVG upload capabilities for Author-level users if business operations permit
• Implement strict Content Security Policy (CSP) headers to mitigate the impact of any stored XSS payloads

Patch Information

A patch for this vulnerability should be obtained from the official WordPress plugin repository. Administrators should monitor the WordPress Plugin File repository and the Wordfence Vulnerability Report for updates on available patches. Until a patch is released, implement the workarounds below to reduce exposure.

Workarounds

• Restrict SVG upload permissions to only Administrators or trusted roles using WordPress role management plugins
• Implement server-side SVG sanitization using libraries that strip potentially dangerous elements before storage
• Configure your web server or WAF to block or sanitize SVG files containing JavaScript elements
• Consider disabling the AM LottiePlayer plugin entirely until a patched version is available

# WordPress wp-config.php - Restrict file upload types (add before "That's all, stop editing!")
# Note: This is a general restriction; plugin-specific settings may be needed
define('ALLOW_UNFILTERED_UPLOADS', false);