Player Leaderboard

Player Leaderboard has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it is fixed as of September 2026. Their average CVSS score is 8.8, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 1 high.

The most common weakness is PHP Remote File Inclusion, behind 1 of the records (100%).

The one issue recorded for Player Leaderboard has a vendor fix available, so running the current release closes it.

All of these findings were reported by kr0d. Player Leaderboard is installed on roughly 30 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.

Strategic Overview

Avg CVSSHigh
8.8/ 10
Patch Coverage100%
Open

0

Fixed

1

Get automatic notifications for all Player Leaderboard vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.8CVE-2025-12824

Player Leaderboard 1.0.0 - 1.0.2 - Authenticated (Contributor+) Local File Inclusion

Read the full analysis

Vulnerability Records

1 records
Player Leaderboard banner
Latestv1.1

Player Leaderboard

tharkun69

Author

tharkun69

0.0(0)
0/100
Last Updated
2026-07-21 (2mo ago)
Active Installs
30+
Downloads
5,730
Requires WP
6.5+
Requires PHP
7.4+
Tested up to
WP 7.0.4
Created
2021-02-05 (6y ago)

Player Leaderboard provides a complete, free workflow for managing sports rankings in WordPress. Administrators create competitions, add players or teams, enter results and publish the calculated tables on any page or post. The plugin supports singles, doubles and team competitions. Standings use configurable points for victories, defeats and draws. Individual and doubles rankings can take opponent strength, bonuses and rating history into account. There is one free edition of Player Leaderboard. No premium edition or paid feature gate is required. Features Create singles, doubles and team competitions. Manage players or teams and their contact information. Record one result or up to ten results at once. Configure points, sets, ratings, bonuses and ranking behaviour. Display standings, rankings and duel matrices on the front end. Optionally show result-detail dialogs. Import and export competitions, players and results as CSV. Configure table and matrix colours per competition. Use responsive, horizontally scrollable tables without clipped columns. Read expanded context-sensitive help and workflow guides while editing a competition. View complete shortcode documentation in the competition overview and directly below the editor help. Basic workflow Open Player Leaderboard in the WordPress administration area. Create a competition and select its type and scoring rules. Add the participating players or teams. Enter the match results. Copy the shortcode shown in the competition list to a page or post. Shortcode The competition ID is required: [player_leaderboard id="1"] Available attributes: id – Numeric competition ID. Required. mode – Output type: standing (default), ranking or matrix. showheader – Set to true to show the competition title and view heading. Default: false. details – Set to true to make standing or matrix values open result-detail dialogs. Default: false. view – Ranking calculation shown for doubles: points (default), quotient, rating, ratings or average. type – Matrix value: games (default), sets, points or rating. matrix_font_size – Matrix font size in pixels from 8 to 32. If omitted, the responsive default size is used. fontweight – Legacy responsive matrix font-size factor from 1 to 500. Default: 100. width – Minimum matrix width with a supported CSS unit, for example 100%, 720px or 50rem. If less space is available, the matrix becomes horizontally scrollable. Default: 100%. Examples: [player_leaderboard id="1" mode="standing" showheader="true" details="true"] [player_leaderboard id="1" mode="ranking" view="average"] [player_leaderboard id="1" mode="matrix" type="sets" details="true" matrix_font_size="12" width="100%"] CSV import and export Use the CSV export generated by Player Leaderboard as the template for imports. A complete competition export can contain competition, player and result rows. During import you can choose whether existing rating values are reset and whether result rows are imported. For security, CSV uploads are limited to .csv files up to 5 MB and are available only to administrators.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C