AM LottiePlayer

AM LottiePlayer has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2025 and 2026; 1 is fixed and 1 remains unpatched as of September 2026. Their average CVSS score is 5.9, and the most serious one scores 6.4 out of 10.

The most common weakness is Cross-Site Scripting, behind 2 of the records (100%).

1 of the records (50%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2026.

2 independent researchers contributed these findings, one record each. AM LottiePlayer is installed on roughly 800 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSMedium
5.9/ 10
Patch Coverage50%
Open

1

Fixed

1

Get automatic notifications for all AM LottiePlayer vulnerabilities before they are exploited.

Most severe open issueCVSS 5.4CVE-2025-1794

AM LottiePlayer <= 3.6.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG

Read the full analysis

Vulnerability Records

2 records
AM LottiePlayer banner
Latestv4.1.1
5.0(5)
100/100
Last Updated
2026-09-10 (3d ago)
Active Installs
800+
Downloads
30,855
Requires WP
5.9+
Requires PHP
7.4+
Tested up to
WP 7.1
Created
2022-12-12 (4y ago)

The most complete free Lottie Player yet. AM LottiePlayer is easy to use, lightweight, and gives you total control over how to implement crisp, vectorized animations to your website. Easily set up user interactions, choose between JSON or the optimized dotLottie format, choose whether to serve the files from a CDN or your own Media Library, choose how to scale the animation, add a nice description for screen readers and search eninge crawlers, and you’re off to the races! Upload Lottie animations to WordPress and add them to Gutenberg, Divi, Elementor, Bricks, Flatsome UX Builder, or via the shortcode [am-lottieplayer]. This plugin also offer partial support for WPBakery (formerly Visual Studio). Features Contains two Gutenberg blocks: a player and a cover block with text overlay – great for headers. Contains a Divi Builder Module Contains an Elementor Widget Contains a Bricks Element Contains the shortcode [am-lottieplayer] Has intergration for Flatsome UX Builder Has partial support for WPBakery (formerly Visual Studio) Scripts are only loaded for pages where the player is used Upload Lottie JSON or dotLottie files to your Media Library Drag & drop a Lottie JSON or dotLottie file Insert a Lottie JSON or dotLottie animation from URL Choose scaling, speed, size, background color, interactions and more from the block settings in Gutenberg. The same settings are accessible in the Divi Module menu, the Elementor Widget menu, the Flatsome UX Builder menu, and WPBakery menu. Links Website AM LottiePlayer PRO PRO AM LottiePlayer is also available in a professional version, which includes more functionality and flexibility. The AM LottiePlayer PRO features are: Combine animations in a single file via drag and drop Control interactions and behaviour of each animation in multi-animation files Convert JSON-lotties to dotLottie in an easy-to use GUI Choose renderer: SVG, Canvas or HTML More of the functionality from animations made with After Effects Upgrade to AM LottiePlayer PRO Feedback We’d love to hear from you! Thanks for using our plugin! Please take a moment to rate it. Translations You can contribute your translation here. New to Translating WordPress? Read through the Translator Handbook to get started.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C