AM LottiePlayer

AM LottiePlayer has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2025 and 2026; all 2 are fixed as of October 2026. Their average CVSS score is 5.9, and the most serious one scores 6.4 out of 10.

The most common weakness is Cross-Site Scripting, behind 2 of the records (100%).

Every one of the 2 issues recorded for AM LottiePlayer has a vendor fix available, so running the current release closes all known holes.

2 independent researchers contributed these findings, one record each. AM LottiePlayer is installed on roughly 800 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

Strategic Overview

Avg CVSSMedium
5.9/ 10
Patch Coverage100%
Open

0

Fixed

2

Get automatic notifications for all AM LottiePlayer vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.4CVE-2025-1529

AM LottiePlayer <= 3.5.3 - Authenticated (Author+) Stored Cross-Site Scripting via Uploaded Lottie File

Read the full analysis

Vulnerability Records

2 records
AM LottiePlayer banner
Latestv4.2.6
5.0(5)
100/100
Last Updated
2026-10-08 (19d ago)
Active Installs
800+
Downloads
34,018
Requires WP
5.9+
Requires PHP
8.0+
Tested up to
WP 7.1.3
Created
2022-12-12 (4y ago)

The most complete free Lottie Player yet. AM LottiePlayer is easy to use, lightweight, and gives you total control over how to implement crisp, vectorized animations to your website. Easily set up user interactions, choose between JSON or the optimized dotLottie format, choose whether to serve the files from a CDN or your own Media Library, choose how to scale the animation, add a nice description for screen readers and search engine crawlers, and you’re off to the races! Upload Lottie animations to WordPress and add them to Gutenberg, Divi, Elementor, Bricks, Flatsome UX Builder, or via the shortcode [am-lottieplayer]. This plugin also offer partial support for WPBakery (formerly Visual Studio). Features Contains two Gutenberg blocks: a player and a cover block with text overlay – great for headers. Contains a Divi Builder Module Contains an Elementor Widget Contains a Bricks Element Contains the shortcode [am-lottieplayer] Has integration for Flatsome UX Builder Has partial support for WPBakery (formerly Visual Studio) Scripts are only loaded for pages where the player is used Upload Lottie JSON or dotLottie files to your Media Library Drag & drop a Lottie JSON or dotLottie file Insert a Lottie JSON or dotLottie animation from URL Choose scaling, speed, size, background color, interactions and more from the block settings in Gutenberg. The same settings are accessible in the Divi Module menu, the Elementor Widget menu, the Flatsome UX Builder menu, and WPBakery menu. Links Website AM LottiePlayer PRO PRO AM LottiePlayer is also available in a professional version, which includes more functionality and flexibility. The AM LottiePlayer PRO features are: Combine animations in a single file via drag and drop Control interactions and behavior of each animation in multi-animation files Convert JSON-lotties to dotLottie in an easy-to use GUI Choose renderer: SVG, Canvas or HTML More of the functionality from animations made with After Effects Upgrade to AM LottiePlayer PRO Feedback We’d love to hear from you! Thanks for using our plugin! Please take a moment to rate it. Translations You can contribute your translation here. New to Translating WordPress? Read through the Translator Handbook to get started.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C