The AM LottiePlayer plugin for WordPress allows users with Author or higher roles to upload SVG files. The plugin does not sanitize or escape the content of those SVG files, which leads to stored cross‑site scripting. A malicious actor can embed JavaScript within the SVG, and the script will execute in the browsers of visitors who view the affected page, allowing the attacker to run arbitrary scripts on the site.

The flaw is present in all releases of AM LottiePlayer up to and including version 3.6.0. WordPress sites that have this plugin installed and permit Author‑level users to upload SVG files are impacted. Any site that has not upgraded beyond 3.6.0 should be inspected for the presence of the plugin and the uploaded SVG content.

The CVSS base score of 5.4 indicates a moderate severity vulnerability. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting a lower current exploitation likelihood. Nonetheless, the requirement for an authenticated Author or higher user to upload an SVG is a realistic scenario in many collaborative WordPress environments. Once exploited, the injected script runs for every visitor to the affected page, providing a persistent attack surface. The exploitation path is straightforward: an authenticated user uploads a crafted SVG through the plugin’s interface.