CVE-2024-5644

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Tournamatch WordPress plugin before 4.6.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:L

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jul 13, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-564407.5Permission control vulnerability in the Connectivity module Impact: Successful exploitation of this vulnerability may cause features to perfCVE-2024-564415.9Race condition vulnerability in the Bastet module Impact: Successful exploitation of this vulnerability may affect service confidentiality.CVE-2024-564427.5Vulnerability of native APIs not being implemented in the NFC service module Impact: Successful exploitation of this vulnerability may causeCVE-2024-564437.5Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service CVE-2024-564447.5Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service CVE-2024-564455.3Instruction authentication bypass vulnerability in the Findnetwork module Impact: Successful exploitation of this vulnerability may cause feCVE-2024-564467.5Vulnerability of variables not being initialized in the notification module Impact: Successful exploitation of this vulnerability may affectCVE-2024-564477.5Vulnerability of improper permission control in the window management module Impact: Successful exploitation of this vulnerability may affecCVE-2024-564487.5Vulnerability of improper access control in the home screen widget module Impact: Successful exploitation of this vulnerability may affect aCVE-2024-564497.5Privilege escalation vulnerability in the Account module Impact: Successful exploitation of this vulnerability may affect service confidentiCVE-2024-56455.4The Envo Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘button_css_id’ parameter within the Button widget CVE-2024-564505.5Buffer overflow vulnerability in the component driver module Impact: Successful exploitation of this vulnerability may affect availability.
CVE-2024-5644: Medium severity, CVSS 5.4 | Vulnix