The vulnerability is an improper neutralization of input during web page generation that allows reflected XSS. When a crafted value is included in a request, the Tournamatch plugin echoes it back without adequate escaping, enabling an attacker to run arbitrary JavaScript in the victim’s browser. This can lead to credential theft, session hijacking, defacement or the execution of other malicious payloads within the context of the site.

All installations of the WordPress Tournamatch plugin up to and including version 4.7.0 are affected. The issue originates from the Tournamatch:Tournamatch product. No other plugins or core WordPress components are mentioned as impacted.

The CVSS score of 7.1 indicates a high severity. The EPSS score of less than 1% shows a very low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a reflected XSS attack that requires an attacker to supply a crafted URL or form input; the payload is executed only in the client’s browser and does not affect server integrity or data confidentiality. Due to the client‑side nature of the flaw, widespread impact would rely on users clicking malicious links or visiting infected pages.