Arbitrary File Read Vulnerability in CLEVER HTML5 Radio Player Plugin for WordPress
CVE-2025-3103

7.5HIGH

Key Information:

Vendor

WordPress
Status
Clever - Html5 Radio Player With History - Shoutcast And Icecast - Elementor Widget Addon
Vendor
CVE Published:
19 April 2025

What is CVE-2025-3103?

The CLEVER HTML5 Radio Player With History plugin for WordPress is susceptible to arbitrary file read vulnerabilities due to inadequate file path validation in the 'history.php' file. This flaw, present in all versions up to and including 2.4, allows unauthorized attackers to access any file on the server hosting the affected site, potentially exposing sensitive information such as database credentials. A partial patch has been implemented in version 2.4, yet the issue still merits serious attention to ensure comprehensive protection against data breaches.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

CLEVER - HTML5 Radio Player With History - Shoutcast and Icecast - Elementor Widget Addon * <= 2.4

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://codecanyon.net/item/clever-html5-radio-player-wit...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tran Nguyen Bao Khanh (from VCI - VNPT Cyber Immunity)
JSON
.