How severe is CVE-2025-3103?

High severity. CVSS v3 base score is 7.5 out of 10.

Vulnerability in Lambertgroup Clever - Html5 Radio Player With History Shoutcast And Icecast Elementor Widget Addon

CVE-2025-3103

The CLEVER - HTML5 Radio Player With History - Shoutcast and Icecast - Elementor Widget Addon plugin for WordPress is vulnerable to arbitrary file read due to insufficient file path validation in the 'history.php' file in all versions up to, and including, 2.4. This makes it possible for unauthenticated attackers to read arbitrary files on the affected site's server, which may contain sensitive information including database credentials. The vulnerability was partially patched in version 2.4.

EPSS: 0.004 (30.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Lambertgroup Clever - Html5 Radio Player With History Shoutcast And Icecast Elementor Widget Addon — versions 0

Weakness classification (CWE)

CWE-73 — External Control of File Name or Path

References

Frequently asked questions

What is CVE-2025-3103?: CVE-2025-3103 is a high-severity vulnerability in Lambertgroup Clever - Html5 Radio Player With History Shoutcast And Icecast Elementor Widget Addon, classified under External Control of File Name or Path. CVSS score: 7.5/10. Published 2025-04-19.
How severe is CVE-2025-3103?: High severity. CVSS v3 base score is 7.5 out of 10.