Tournamatch vulnerabilities
We track 2 vulnerabilities in Tournamatch products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on November 7, 2026.
2vulnerabilities
1critical
1high
0exploited
8.3average CVSS score
Latest Tournamatch vulnerabilities
- 9.6 Critical severity
Tournamatch: External Control of File Name or Path
The Tournamatch WordPress plugin before 4.7.1 does not validate or restrict the path of a previously stored profile or team image before deleting it when a new image is uploaded, allowing users with a role as low as Subscriber to delete arbitrary files on the
- 7.1 High severity
Tournamatch: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tournamatch Tournamatch tournamatch allows Reflected XSS.This issue affects Tournamatch: from n/a through <= 4.7.0.