SQL Injection Vulnerability in LambertGroup Chameleon HTML5 Audio Player
CVE-2025-32307

8.5HIGH

Key Information:

Vendor: WordPress
Status: Chameleon Html5 Audio Player With/without Playlist
Vendor: CVE Published:; 16 May 2025

What is CVE-2025-32307?

A vulnerability exists in LambertGroup's Chameleon HTML5 Audio Player, which allows an attacker to exploit improper neutralization of special elements in SQL commands, leading to SQL injection attacks. This issue affects users of the player from version 3.5.6 and earlier, potentially exposing sensitive data and compromising database integrity.

Affected Version(s)

Chameleon HTML5 Audio Player With/Without Playlist <= 3.5.6

References

https://patchstack.com/database/wordpress/plugin/lbg-audi...

vdb-entry

CVSS V3.1

Score:

8.5

Severity:

HIGH

Confidentiality:

High

Integrity:

None

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

None

Scope:

Changed

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
May 16, 2025
Vulnerability Reserved
Apr 4, 2025

Credit

Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) (Patchstack Alliance)