Tournamatch

Tournamatch has 4 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2025; 3 are fixed and 1 remains unpatched as of September 2026. Their average CVSS score is 5.8, and the most serious one scores 6.4 out of 10. 2025 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Scripting, behind 4 of the records (100%).

3 of the records (75%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2025.

4 independent researchers contributed these findings, one record each. Tournamatch is installed on roughly 100 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.0.

Strategic Overview

Avg CVSSMedium
5.8/ 10
Patch Coverage75%
Open

1

Fixed

3

Get automatic notifications for all Tournamatch vulnerabilities before they are exploited.

Most severe open issueCVSS 6.1CVE-2025-32600

Tournamatch <= 4.6.2 - Reflected Cross-Site Scripting

Read the full analysis

Vulnerability Records

4 records
Plugin Profile
Latestv4.7.0
4.2(6)
84/100
Last Updated
2025-12-09 (9mo ago)
Active Installs
100+
Downloads
10,276
Requires WP
4.7+
Requires PHP
5.6.20+
Tested up to
WP 6.9.0
Created
2022-06-04 (4y ago)

Use this plugin to create a gaming community with your own tournaments, ladders, competitor challenges, and more. Ladder standings (or “leaderboard”) track points, wins, losses, [optionally] draws, games played, win streak, and win percent. Tournament brackets support single elimination head-to-head competitions. Tournamatch also includes match challenges, player profiles, team profiles, ladder and tournament rule pages, match lists, and a player dashboard for managing everything. Using Tournamatch, you create ladder or tournament events and allow registered users to self-serve. Registered users can create their own teams, join other teams, accept or decline join requests, drop team members, and send email or user team invitations; users can send match challenges; users or admins report, confirm, or dispute match results; ladders and tournaments will update automatically when match results are confirmed. This plugin includes many pages and shortcodes with user-facing components. You should expect to restyle those using the WordPress Backend -> Appearance, Customize -> Additional CSS page. Need support or have a feature request? Please reach out to us here on the WordPress.org forums, on Twitter at @tournamatch, on Facebook at Tournamatch, or visit our website at www.tournamatch.com.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C