CVE-2025-3103

CLEVER - HTML5 Radio Player With History - Shoutcast and Icecast - Elementor Widget Addon <= 2.4 - Unauthenticated Arbitrary File Read

View on CVE.org

Published Apr 19, 2025 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Description

The CLEVER - HTML5 Radio Player With History - Shoutcast and Icecast - Elementor Widget Addon plugin for WordPress is vulnerable to arbitrary file read due to insufficient file path validation in the 'history.php' file in all versions up to, and including, 2.4. This makes it possible for unauthenticated attackers to read arbitrary files on the affected site's server, which may contain sensitive information including database credentials. The vulnerability was partially patched in version 2.4.

Analysis

Technical impact

The vulnerability (CWE‑73) allows an unauthenticated attacker to retrieve arbitrary files from the server hosting the WordPress site. A flaw in the plugin’s history.php file fails to validate file paths, enabling an attacker to construct a web request that resolves to any file on the filesystem, potentially exposing sensitive information such as database credentials or other configuration data.

Affected Systems

The flaw exists in the CLEVER – HTML5 Radio Player With History – Shoutcast and Icecast – Elementor Widget Addon plugin for WordPress. All releases up to and including version 2.4 are affected.

Risk and Exploitability

With a CVSS score of 7.5 the issue is classified as high severity. The EPSS score is less than 1%, indicating that the likelihood of exploitation is currently low, and the vulnerability is not listed in the CISA KEV catalog. An attacker can exploit the flaw remotely via a simple web request without requiring authentication, and can target any user who can reach the WordPress installation.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

LambertGroup

CLEVER - HTML5 Radio Player With History - Shoutcast and Icecast - Elementor Widget Addon

unaffected

Version	Status	Constraints
`0`	affected	≤ 2.4

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the CLEVER plugin to the latest available release; if version 2.4 is the latest and still vulnerable, use any newer version that fully addresses the path‑validation flaw.
If an upgrade is not immediately possible, remove or disable the history.php file or disable the history feature of the plugin to eliminate the vulnerable endpoint.
Configure restrictive file‑system permissions so that the web server runs with the least privilege necessary, preventing read access to sensitive files such as wp-config.php.

Generated by OpenCVE AI on April 28, 2026 at 18:56 UTC.

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2025-15088	The CLEVER - HTML5 Radio Player With History - Shoutcast and Icecast - Elementor Widget Addon plugin for WordPress is vulnerable to arbitrary file read due to insufficient file path validation in the 'history.php' file in all versions up to, and including, 2.4. This makes it possible for unauthenticated attackers to read arbitrary files on the affected site's server, which may contain sensitive information including database credentials. The vulnerability was partially patched in version 2.4.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.406% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://codecanyon.net/item/clever-html5-radio-player-with-history-shoutcast-and-icecast-elementor-widget-addon/26708087#item-description__updates-release-log
https://www.wordfence.com/threat-intel/vulnerabilities/id/0733261f-a2e1-4bd1-a57d-fdaaa8c904db?source=cve

History

Apr 21, 2025 3:15 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Apr 19, 2025 4:45 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The CLEVER - HTML5 Radio Player With History - Shoutcast and Icecast - Elementor Widget Addon plugin for WordPress is vulnerable to arbitrary file read due to insufficient file path validation in the 'history.php' file in all versions up to, and including, 2.4. This makes it possible for unauthenticated attackers to read arbitrary files on the affected site's server, which may contain sensitive information including database credentials. The vulnerability was partially patched in version 2.4.
Title		CLEVER - HTML5 Radio Player With History - Shoutcast and Icecast - Elementor Widget Addon <= 2.4 - Unauthenticated Arbitrary File Read
Weaknesses		CWE-73
References		https://codecanyon.net/item/clever-html5-radio-player-with-history-shoutcast-and-icecast-elementor-widget-addon/26708087#item-description__updates-release-log https://www.wordfence.com/threat-intel/vulnerabilities/id/0733261f-a2e1-4bd1-a57d-fdaaa8c904db?source=cve
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}`