LottieFiles
LottieFiles has 2 disclosed vulnerabilities in the WordSec catalog, all reported in 2026; all 2 are fixed as of September 2026. Their average CVSS score is 7.6, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 0 high. 2026 was the busiest year with 2 disclosures.
The most common weakness is Exposure Of Sensitive Information To An Unauthorized Actor, behind 1 of the records (50%). Other recurring categories include Missing Authorization.
Every one of the 2 issues recorded for LottieFiles has a vendor fix available, so running the current release closes all known holes.
2 independent researchers contributed these findings, one record each. LottieFiles is installed on roughly 7,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.
CVE-2025-68043LottieFiles <= 3.0.0 - Missing Authorization
Read the full analysisVulnerability Records
LottieFiles
Author
LottieFiles
LottieFiles for WordPress gives you access to over 50k free and ready to use Lottie animations that you can easily embed on your website. Adding animations is quick and simple: simply drag and drop the animation of your choice anywhere in your page and post and make your site stand out, no coding or design skills needed. Bring your content to life and explain your product and service in a more exciting way to your users! Features Transform your website into animated web experiences using the Gutenberg Editor Search and access over 50,000 free and ready to use Lottie animations Access to your Private files from LottieFiles Drag & drop a Lottie JSON file Insert a Lottie animation from URL Save and re-use animation data JSON files through the WordPress Media Library Customize your Lottie, everything is configurable directly within the the Gutenberg Editor, through the block’s controls Includes customization options, allowing you to customize: Background color of the animation The speed of the animation Play on page load, click, scroll or mouse over Loop the animation or play once Play the animation in reverse The dimensions (width and max width) with responsive controls 3.1.0 Security Fixed unauthenticated REST API endpoint vulnerability (CVE-2026-0717) Added proper permission callbacks and capability checks to REST API endpoints Removed “Share LottieFiles account with other users” feature 3.0.0 Minor Changes Fixes breaking changes in Gutenberg 2.9.0 Minor Changes Dependencies update and BugSnap implementation 2.8.0 Minor Changes Fix for Lottie block throwing block validation error 2.7.0 Minor Changes fix for LottieFiles WP plugin’s CSS affects other input elements in the WP Block Editor 2.6.0 Minor Changes fix for plugin affecting UI of other wordpress pages 2.5.0 Minor Changes dotLottie support refactor interactivity bugs fixed CDN enable for new users error solved 2.4.0 Minor Changes New feature to give an option for the user to use the CDN or use local player Fix for animation play on hover, click and scroll Search feature gate removed on workspaces 2.3.0 Minor Changes Fixes for lottie player size on safari browser 2.2.0 Minor Changes Fixes for pagination, search and interactivity 2.1.0 Minor Changes Fixes for Gutenberg plugin compatibility and sidebar UI enhancements 2.0.0 Major Changes Major workflow update 1.1.0 Minor Changes Fixed Block Movement/ Drag & Drop issue fixed Import from media library 1.0.5 Patch Changes UI fixes, copy fixes 1.0.4 Patch Changes Hit counter fix Interactivity scroll fix CSS Namespace population fix Only load CSS where relevant 1.0.3 Patch Changes Upload JSON fixes 1.0.2 Patch Changes Update common php function names to be unique to avoid namespace clashes 1.0.1 Patch Changes Documentation updates for readme and dev readme Updates for WordPress SVN listing 1.0.0 Major Changes First stable release
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C