Tournamatch
Tournamatch has 4 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2025; 3 are fixed and 1 remains unpatched as of September 2026. Their average CVSS score is 5.8, and the most serious one scores 6.4 out of 10. 2025 was the busiest year with 2 disclosures.
The most common weakness is Cross-Site Scripting, behind 4 of the records (100%).
3 of the records (75%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2025.
4 independent researchers contributed these findings, one record each. Tournamatch is installed on roughly 100 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.0.
CVE-2025-32600Tournamatch <= 4.6.2 - Reflected Cross-Site Scripting
Read the full analysisVulnerability Records
Tournamatch
Author
Tournamatch
Use this plugin to create a gaming community with your own tournaments, ladders, competitor challenges, and more. Ladder standings (or “leaderboard”) track points, wins, losses, [optionally] draws, games played, win streak, and win percent. Tournament brackets support single elimination head-to-head competitions. Tournamatch also includes match challenges, player profiles, team profiles, ladder and tournament rule pages, match lists, and a player dashboard for managing everything. Using Tournamatch, you create ladder or tournament events and allow registered users to self-serve. Registered users can create their own teams, join other teams, accept or decline join requests, drop team members, and send email or user team invitations; users can send match challenges; users or admins report, confirm, or dispute match results; ladders and tournaments will update automatically when match results are confirmed. This plugin includes many pages and shortcodes with user-facing components. You should expect to restyle those using the WordPress Backend -> Appearance, Customize -> Additional CSS page. Need support or have a feature request? Please reach out to us here on the WordPress.org forums, on Twitter at @tournamatch, on Facebook at Tournamatch, or visit our website at www.tournamatch.com.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C