The AM LottiePlayer plugin for WordPress is vulnerable to stored cross‑site scripting because uploaded lottie files are not properly sanitized or escaped. Authenticated authors or higher can embed arbitrary JavaScript into a lottie file, and the code will execute in the browsers of any user who views a page rendering that file. This could be used for session hijacking, credential theft, or malicious redirection.

The vulnerability affects the AM LottiePlayer plugin provided by johanaarstein in all releases up to and including version 3.5.3. Any WordPress installation running one of these versions is potentially affected.

The CVSS score of 6.4 indicates a moderate severity, while the EPSS score of < 1% suggests a low probability of active exploitation at this time. The vulnerability is not listed in CISA KEV. Exploitation requires an authenticated user with Author or higher privileges to upload a malicious lottie file, after which any user who view the affected page will have their browser compromised. The attack vector is likely an authenticated file upload rather than an unauthenticated remote request.