WordPress Tournamatch plugin <= 4.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Chuck in WordPress Plugin Tournamatch versions = 4.6.1...

CVE-2025-4594

creationtimestamp| type| source ---|---|--- 2025-05-23 04:49:48+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/17371 2025-05-23 07:25:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lpt42mtxzh2k...

CVE-2025-4594

CVE-2025-4594 refers to the WordPress plugin Tournamatch. The vulnerability is a stored cross-site scripting (XSS) arising from insufficient input sanitization and output escaping in the trn-ladder-registration-button shortcode, affecting versions up to and including 4.6.1. An authenticated attac...