AM LottiePlayer
AM LottiePlayer has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2025 and 2026; all 2 are fixed as of October 2026. Their average CVSS score is 5.9, and the most serious one scores 6.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 2 of the records (100%).
Every one of the 2 issues recorded for AM LottiePlayer has a vendor fix available, so running the current release closes all known holes.
2 independent researchers contributed these findings, one record each. AM LottiePlayer is installed on roughly 800 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.
CVE-2025-1529AM LottiePlayer <= 3.5.3 - Authenticated (Author+) Stored Cross-Site Scripting via Uploaded Lottie File
Read the full analysisVulnerability Records

AM LottiePlayer
Author
Johan Martin Aarstein
The most complete free Lottie Player yet. AM LottiePlayer is easy to use, lightweight, and gives you total control over how to implement crisp, vectorized animations to your website. Easily set up user interactions, choose between JSON or the optimized dotLottie format, choose whether to serve the files from a CDN or your own Media Library, choose how to scale the animation, add a nice description for screen readers and search engine crawlers, and you’re off to the races! Upload Lottie animations to WordPress and add them to Gutenberg, Divi, Elementor, Bricks, Flatsome UX Builder, or via the shortcode [am-lottieplayer]. This plugin also offer partial support for WPBakery (formerly Visual Studio). Features Contains two Gutenberg blocks: a player and a cover block with text overlay – great for headers. Contains a Divi Builder Module Contains an Elementor Widget Contains a Bricks Element Contains the shortcode [am-lottieplayer] Has integration for Flatsome UX Builder Has partial support for WPBakery (formerly Visual Studio) Scripts are only loaded for pages where the player is used Upload Lottie JSON or dotLottie files to your Media Library Drag & drop a Lottie JSON or dotLottie file Insert a Lottie JSON or dotLottie animation from URL Choose scaling, speed, size, background color, interactions and more from the block settings in Gutenberg. The same settings are accessible in the Divi Module menu, the Elementor Widget menu, the Flatsome UX Builder menu, and WPBakery menu. Links Website AM LottiePlayer PRO PRO AM LottiePlayer is also available in a professional version, which includes more functionality and flexibility. The AM LottiePlayer PRO features are: Combine animations in a single file via drag and drop Control interactions and behavior of each animation in multi-animation files Convert JSON-lotties to dotLottie in an easy-to use GUI Choose renderer: SVG, Canvas or HTML More of the functionality from animations made with After Effects Upgrade to AM LottiePlayer PRO Feedback We’d love to hear from you! Thanks for using our plugin! Please take a moment to rate it. Translations You can contribute your translation here. New to Translating WordPress? Read through the Translator Handbook to get started.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C