The Tournamatch WordPress plugin contains a stored cross‑site scripting flaw in the 'trn-ladder-registration-button' shortcode. Insufficient sanitization and escaping of user supplied attributes allow an authenticated attacker with contributor‑level or higher permissions to inject arbitrary JavaScript. Once injected, the script executes every time a site visitor accesses the affected page, potentially leading to session hijacking, credential theft, defacement, or further spread of malware. The weakness is a classic input validation error (CWE‑79).

The vulnerability affects the Tournamatch plugin for WordPress, in all releases up to and including version 4.6.1. Administrators using any of these versions should verify that they are running the plugin at that revision or earlier.

The weakness carries a CVSS score of 6.4, indicating moderate severity. The EPSS score is below 1%, suggesting a low likelihood of exploitation at the current time, and the issue is not listed in the CISA KEV catalog. The attack vector requires authenticated access with contributor‑level privileges, meaning the attacker must already have a valid user account on the site. Once the payload is stored, every visitor to the page will run the malicious code, so the impact could be widespread across the website's user base. Given the low EPSS, exploitation is not yet prevalent, but the moderate CVSS warrants proactive remediation.