PT-2025-21692 · WordPress · Lambertgroup Radio Player Shoutcast & Icecast Wordpress Plugin

Tran Nguyen Bao Khanh · Published 2025-05-16 · Updated 2025-05-16 · CVE-2025-32306

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

Name of the Vulnerable Software and Affected Versions: LambertGroup Radio Player Shoutcast & Icecast WordPress Plugin versions through 4.4.6

Description: The issue is related to an SQL Injection vulnerability, specifically Improper Neutralization of Special Elements used in an SQL Command. This allows for Blind SQL Injection, which can be exploited.

Recommendations: For versions through 4.4.6, upgrade to a version higher than 4.4.6 to resolve the issue. As a temporary workaround, consider restricting access to sensitive database elements to minimize the risk of exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-32306

Affected Products

Lambertgroup Radio Player Shoutcast & Icecast Wordpress Plugin

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-32306 · Security Note
• https://twitter.com/CveFindCom/status/1923409086302781875 · Twitter Post
• https://twitter.com/CVEnew/status/1923434409270837369 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/audio4-html5/vulnerability/wordpress-radio-player-shoutcast-icecast-wordpress-plugin-4-4-6-sql-injection-vulnerability?_s_id=cve · Note
• https://patchstack.com/database/wordpress/plugin/audio4-html5/vulnerability/wordpress-radio-player-shoutcast-icecast-wordpress-plugin-4-4-6-sql-injection-vulnerability?_s_id=cve · Note