WordPress Tournamatch plugin < 4.7.1 - Subscriber+ Arbitrary File Deletion vulnerability

Subscriber+ Arbitrary File Deletion vulnerability discovered by AJA in WordPress Plugin Tournamatch versions 4.7.1...

CVE-2026-121380

The Tournamatch WordPress plugin before 4.7.1 does not restrict access to its team invitation listing, allowing unauthenticated users to retrieve the email addresses of people invited to join teams...

CVE-2026-121379

The Tournamatch WordPress plugin before 4.7.1 does not validate or restrict the path of a previously stored profile or team image before deleting it when a new image is uploaded, allowing users with a role as low as Subscriber to delete arbitrary files on the server, such as wp-config.php, which...

CVE-2026-121379 Tournamatch < 4.7.1 - Subscriber+ Arbitrary File Deletion

The Tournamatch WordPress plugin before 4.7.1 does not validate or restrict the path of a previously stored profile or team image before deleting it when a new image is uploaded, allowing users with a role as low as Subscriber to delete arbitrary files on the server, such as wp-config.php, which...

EUVD-2026-118942

The Tournamatch WordPress plugin before 4.7.1 does not restrict access to its team invitation listing, allowing unauthenticated users to retrieve the email addresses of people invited to join teams...

CVE-2026-121379

The Tournamatch WordPress plugin (versions before 4.7.1 ) is vulnerable to an arbitrary file deletion flaw. The plugin fails to validate or restrict the path of a previously stored profile or team image when a new image is uploaded. This allows users with privileges as low as Subscriber to delete...

EUVD-2026-118941

The Tournamatch WordPress plugin before 4.7.1 does not validate or restrict the path of a previously stored profile or team image before deleting it when a new image is uploaded, allowing users with a role as low as Subscriber to delete arbitrary files on the server, such as wp-config.php, which...

CVE-2026-121380

The Tournamatch WordPress plugin (versions before 4.7.1 ) is vulnerable to an unauthenticated team invitation email disclosure. The root cause is a lack of access restrictions on the team invitation listing, which allows unauthenticated users to retrieve the email addresses of individuals invited...

CVE-2026-121380 Tournamatch < 4.7.1 - Unauthenticated Team Invitation Email Disclosure via REST API

The Tournamatch WordPress plugin before 4.7.1 does not restrict access to its team invitation listing, allowing unauthenticated users to retrieve the email addresses of people invited to join teams...

WordPress Tournamatch plugin < 4.7.1 - Unauthenticated Team Invitation Email Disclosure vulnerability

Unauthenticated Team Invitation Email Disclosure vulnerability discovered by ? in WordPress Plugin Tournamatch versions 4.7.1...

PT-2026-139182

Name of the Vulnerable Software and Affected Versions Tournamatch versions prior to 4.7.1 Description Insufficient validation and restriction of the path for stored profile or team images during the upload of a new image allows users with roles as low as Subscriber to delete arbitrary files on th...

EUVD-2025-10756

Malicious code in bioql PyPI...

CVE-2025-4594

The Tournamatch plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'trn-ladder-registration-button' shortcode in all versions up to, and including, 4.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...

CVE-2024-5644

The Tournamatch WordPress plugin before 4.6.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-5627

The Tournamatch WordPress plugin before 4.6.1 does not sanitise and escape some parameters, which could allow users with a role as low as subscriber to perform Cross-Site Scripting attacks...

CVE-2025-4594

The Tournamatch plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'trn-ladder-registration-button' shortcode in all versions up to, and including, 4.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...

CVE-2025-4594

The Tournamatch plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'trn-ladder-registration-button' shortcode in all versions up to, and including, 4.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...

CVE-2025-4594

CVE-2025-4594 refers to the WordPress plugin Tournamatch. The vulnerability is a stored cross-site scripting (XSS) arising from insufficient input sanitization and output escaping in the trn-ladder-registration-button shortcode, affecting versions up to and including 4.6.1. An authenticated attac...

CVE-2025-4594 Tournamatch <= 4.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Tournamatch plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'trn-ladder-registration-button' shortcode in all versions up to, and including, 4.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...

CVE-2025-4594 Tournamatch <= 4.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Tournamatch plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'trn-ladder-registration-button' shortcode in all versions up to, and including, 4.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...