Executive brief
The AM LottiePlayer plugin for WordPress, which is used to display Lottie animations on websites, contains a security flaw in how it handles uploaded files. An attacker with Author-level permissions can upload a malicious image file that contains hidden scripts. When other users or administrators view the page where this file is hosted, the script will run in their browser, potentially allowing the attacker to perform unauthorized actions or steal session information.
Technical details
The AM LottiePlayer plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to improper sanitization of uploaded SVG files. The vulnerability exists in versions up to and including 3.6.0, specifically within the file upload handling (e.g., upload-thumbnail.php). An authenticated attacker with Author-level privileges or higher can upload an SVG file containing malicious JavaScript. Because the plugin fails to properly sanitize the input or escape the output, the script is stored on the server and executed in the context of any user's browser who views the affected page. This can lead to session hijacking or unauthorized administrative actions if a site administrator views the malicious content.
Affected products
- johanaarstein AM LottiePlayer up to, and including, 3.6.0
Timeline
- 2026-04-08: disclosed: Initial publication of the vulnerability advisory.
- 2026-04-08: advisory: Wordfence published the vulnerability details.