Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-10
Tournamatch - Security Vulnerability (CVE-2026-121379)
The Tournamatch WordPress plugin before 4.7.1 does not validate or restrict the path of a previously stored profile or team image before deleting it when a new image is uploaded, allowing users with a role as low as Subscriber to delete arbitrary files on the server, such as wp-config.php, which can lead to a full site takeover.
PLUGIN
Tournamatch
CVE-2026-121379
Risk Score
Threat Entry
Updated 2026-11-10
Tournamatch - Security Vulnerability (CVE-2026-121380)
The Tournamatch WordPress plugin before 4.7.1 does not restrict access to its team invitation listing, allowing unauthenticated users to retrieve the email addresses of people invited to join teams.
PLUGIN
Tournamatch
CVE-2026-121380
Risk Score
Threat Entry
Updated 2026-06-17
Tournamatch - Cross-Site Scripting (XSS) (CVE-2025-4594)
The Tournamatch plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'trn-ladder-registration-button' shortcode in all versions up to, and including, 4.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Tournamatch
CVE-2025-4594
Risk Score
Threat Entry
Updated 2026-06-17
Tournamatch - Cross-Site Scripting (XSS) (CVE-2025-32600)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tournamatch Tournamatch tournamatch allows Reflected XSS.This issue affects Tournamatch: from n/a through
PLUGIN
Tournamatch
CVE-2025-32600
Risk Score
Threat Entry
Updated 2026-06-17
Tournamatch - Cross-Site Scripting (XSS) (CVE-2024-5644)
The Tournamatch WordPress plugin before 4.6.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
PLUGIN
Tournamatch
CVE-2024-5644
Risk Score
Threat Entry
Updated 2026-06-17
Tournamatch - Cross-Site Scripting (XSS) (CVE-2024-5627)
The Tournamatch WordPress plugin before 4.6.1 does not sanitise and escape some parameters, which could allow users with a role as low as subscriber to perform Cross-Site Scripting attacks.
PLUGIN
Tournamatch
CVE-2024-5627
Risk Score