CVE-2025-1529

MediumCVSS 6.4/10Last modified Jun 17, 2026

Description

The AM LottiePlayer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via uploaded lottie files in all versions up to, and including, 3.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
johanaarsteinAM LottiePlayer<= 3.5.3

References

Timeline

Published
May 1, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-15304.3The Tripetto plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 8.0.9. This is due to miCVE-2025-15316.5Authentication credentials leakage vulnerability in Hitachi Ops Center Analyzer viewpoint.This issue affects Hitachi Ops Center Analyzer viCVE-2025-153107.8Tanium addressed a local privilege escalation vulnerability in Patch Endpoint Tools.CVE-2025-153117.8Tanium addressed an unauthorized code execution vulnerability in Tanium Appliance.CVE-2025-153127.2Tanium addressed an improper output sanitization vulnerability in Tanium Appliance.CVE-2025-153137.1Tanium addressed an arbitrary file deletion vulnerability in Tanium EUSS.CVE-2025-153148.1Tanium addressed an arbitrary file deletion vulnerability in end-user-cx.CVE-2025-153157.8Tanium addressed a local privilege escalation vulnerability in Tanium Module Server.CVE-2025-153167.8Tanium addressed a local privilege escalation vulnerability in Tanium Server.CVE-2025-153176.5Tanium addressed an uncontrolled resource consumption vulnerability in Tanium Server.CVE-2025-153186.0Tanium addressed an arbitrary file deletion vulnerability in End-User Notifications Endpoint Tools.CVE-2025-153197.8Tanium addressed a local privilege escalation vulnerability in Patch Endpoint Tools.
CVE-2025-1529: Medium severity, CVSS 6.4 | Vulnix