CVE-2025-1529: AM LottiePlayer Plugin XSS Vulnerability

CVE-2025-1529 Overview

The AM LottiePlayer plugin for WordPress contains a stored Cross-Site Scripting (XSS) vulnerability affecting all versions up to and including 3.5.3. The flaw stems from insufficient input sanitization and output escaping in the handling of uploaded Lottie animation files. Authenticated attackers holding Author-level access or higher can inject arbitrary JavaScript that executes in the browser of any user viewing an affected page. The vulnerability is tracked as CWE-79 and carries a medium severity rating.

Critical Impact
Authenticated attackers with Author-level access can inject persistent JavaScript payloads that execute for every visitor viewing the compromised page, enabling session theft, administrative account takeover, and site defacement.

Affected Products

AM LottiePlayer plugin for WordPress, all versions up to and including 3.5.3
WordPress sites permitting Author-level or higher user registration
WordPress installations with the vulnerable plugin actively enabled

Discovery Timeline

2025-05-01 - CVE-2025-1529 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-1529

Vulnerability Analysis

The AM LottiePlayer plugin renders Lottie animation files supplied by content authors. The plugin fails to sanitize input contained within uploaded Lottie files and does not escape the data on output. Lottie files are JSON documents that the plugin parses and embeds into rendered pages. When an attacker crafts a Lottie file containing script payloads in fields that the plugin echoes back to the DOM, the browser executes the payload in the context of the site origin.

The attack requires authentication at Author level or above, limiting exposure on sites that restrict content contributor roles. However, WordPress instances that accept guest post submissions or delegate authoring to external contributors face direct risk. Scope changes from vulnerable to impacted components because the injected script runs against every visitor's browser session, including administrators.

Root Cause

The plugin trusts the contents of uploaded Lottie JSON files without validating or sanitizing string fields before rendering them. Output escaping routines are absent from the code paths that emit Lottie metadata into HTML. This combination allows raw script content embedded in the animation file to execute when the page loads.

Attack Vector

An authenticated attacker uploads a malicious Lottie file through the plugin's media handling interface. The attacker embeds JavaScript within Lottie fields that the plugin later reflects into page HTML without escaping. When any visitor, including an administrator, loads a page containing the malicious animation, the payload executes with the privileges of that visitor's session. Post-exploitation activities include stealing authentication cookies, injecting administrative users, and pivoting to broader site compromise. Refer to the Wordfence Vulnerability Report for additional technical details.

Detection Methods for CVE-2025-1529

Indicators of Compromise

Uploaded Lottie JSON files containing <script> tags, event handlers such as onerror, or javascript: URI schemes in text or asset fields
Unexpected outbound requests from visitor browsers to attacker-controlled domains after loading pages that embed Lottie animations
New WordPress administrator accounts created shortly after Author-level users publish content containing Lottie files
Modifications to plugin or theme files immediately following content publication by non-administrative users

Detection Strategies

Inspect the WordPress uploads directory for Lottie JSON files and parse them for HTML tags or JavaScript patterns embedded in string values
Review WordPress activity logs for content publications by Author-level accounts that reference the AM LottiePlayer shortcode or block
Deploy web application firewall rules that inspect uploaded JSON for script injection patterns before they reach the plugin

Monitoring Recommendations

Alert on the installation or activation of AM LottiePlayer versions at or below 3.5.3 across managed WordPress fleets
Monitor page responses for anomalous inline script tags associated with Lottie player containers
Track privilege escalation events and unexpected role assignments within WordPress user tables

How to Mitigate CVE-2025-1529

Immediate Actions Required

Update the AM LottiePlayer plugin to a version above 3.5.3 that includes the fix committed in the WordPress Plugin Changeset 3278523
Audit existing Lottie file uploads for embedded script content and remove any files containing suspicious payloads
Review Author-level and higher user accounts, revoking access for accounts that are no longer required

Patch Information

The vendor addressed the vulnerability in the plugin update tracked by changeset 3278523. Site administrators should apply the update through the WordPress plugin management console or by pulling the latest release from the WordPress plugin directory. Verify the installed version after upgrade to confirm remediation.

Workarounds

Deactivate the AM LottiePlayer plugin until the patched version is applied
Restrict content authoring privileges to trusted users only, removing Author-level access from untrusted contributors
Deploy a web application firewall rule set that blocks Lottie JSON uploads containing HTML tags or JavaScript keywords

bash

# Verify installed AM LottiePlayer version via WP-CLI
wp plugin get am-lottieplayer --field=version

# Update the plugin to the latest patched release
wp plugin update am-lottieplayer

# Temporary deactivation while patching is scheduled
wp plugin deactivate am-lottieplayer