AM LottiePlayer Security & Risk Analysis

The "am-lottieplayer" plugin, version 3.6.3, presents a generally positive security posture based on the static analysis. The absence of dangerous functions, SQL queries without prepared statements, file operations, and external HTTP requests are strong indicators of secure coding practices. The high percentage of properly escaped output and the presence of nonce and capability checks further bolster its security. The limited attack surface, with only one shortcode and no unprotected entry points, is also a significant strength.

The vulnerability history, however, reveals a past medium-severity Cross-site Scripting (XSS) vulnerability. While this vulnerability is noted as currently unpatched, the timing of the "last vulnerability" date (2025-04-30) seems to be in the future, which might indicate a data anomaly or that the vulnerability was disclosed recently and a patch is pending. The single CVE, despite being medium severity, warrants attention as it highlights a potential weakness in input handling.

Overall, the plugin demonstrates good security practices in its current codebase. The primary area of concern stems from the past XSS vulnerability, suggesting a need for continued vigilance in input sanitization and output escaping, even if current analysis shows high compliance. Users should ensure they are on the latest version if available to mitigate any previously disclosed vulnerabilities.