WordPress Tournamatch Plugin < 4.6.1 is vulnerable to Cross Site Scripting (XSS)

Software Tournamatch Type Plugin Vulnerable versions 4.6.1 Fixed in 4.6.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5644 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 3c654a015197 Credits Bob Matyas Required privilege...

WordPress Tournamatch Plugin < 4.6.1 is vulnerable to Cross Site Scripting (XSS)

Software Tournamatch Type Plugin Vulnerable versions 4.6.1 Fixed in 4.6.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5627 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 160ba992cf57 Credits Davide Balzano Required...

CVE-2024-5627

The Tournamatch WordPress plugin before 4.6.1 does not sanitise and escape some parameters, which could allow users with a role as low as subscriber to perform Cross-Site Scripting attacks...

CVE-2024-5644

The Tournamatch WordPress plugin before 4.6.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-5627

The Tournamatch WordPress plugin before 4.6.1 does not sanitise and escape some parameters, which could allow users with a role as low as subscriber to perform Cross-Site Scripting attacks...

CVE-2024-5644

The Tournamatch WordPress plugin before 4.6.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-5627 WordPress Plugin Tournamatch < 4.6.1 - Subscriber+ Stored XSS

The Tournamatch WordPress plugin before 4.6.1 does not sanitise and escape some parameters, which could allow users with a role as low as subscriber to perform Cross-Site Scripting attacks...

CVE-2024-5644 WordPress Plugin Tournamatch < 4.6.1 - Admin+ Stored XSS via Ladders

The Tournamatch WordPress plugin before 4.6.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-5627

CVE-2024-5627 affects the Tournamatch WordPress plugin prior to 4.6.1. The vulnerability arises from insufficient sanitisation/escaping of certain parameters, enabling Cross-Site Scripting (XSS) by users with at least subscriber privileges. Red Hat’s advisory and Patchstack entries corroborate th...

CVE-2024-5627 WordPress Plugin Tournamatch < 4.6.1 - Subscriber+ Stored XSS

The Tournamatch WordPress plugin before 4.6.1 does not sanitise and escape some parameters, which could allow users with a role as low as subscriber to perform Cross-Site Scripting attacks...

CVE-2024-5644 WordPress Plugin Tournamatch < 4.6.1 - Admin+ Stored XSS via Ladders

The Tournamatch WordPress plugin before 4.6.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-5644

CVE-2024-5644 affects the Tournamatch WordPress plugin prior to 4.6.1. The issue arises from insufficient sanitisation/escaping of certain plugin settings, enabling Stored XSS by high-privilege users (e.g., administrators) even when unfiltered_html is disabled (such as in multisite). Impact is li...

PT-2024-36777 · WordPress · Tournamatch

Name of the Vulnerable Software and Affected Versions: Tournamatch WordPress plugin versions prior to 4.6.1 Description: The issue allows users with a role as low as subscriber to perform Cross-Site Scripting attacks due to the plugin's failure to sanitise and escape some parameters...

WordPress plugin Tournamatch security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2024-36817 · WordPress · Tournamatch

Name of the Vulnerable Software and Affected Versions: Tournamatch WordPress plugin versions prior to 4.6.1 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html capability is disallowed, fo...

WordPress plugin Tournamatch security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...