CVE-2025-4594 Overview
The Tournamatch plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the trn-ladder-registration-button shortcode. All versions up to and including 4.6.1 are affected. The plugin fails to sanitize input and escape output for user-supplied shortcode attributes. Authenticated users with contributor-level access or higher can inject arbitrary JavaScript into pages. The payload executes in the browser of any user who views an affected page, enabling session theft, redirect attacks, and content manipulation. The issue is tracked as CWE-79.
Critical Impact
Authenticated contributors can inject persistent JavaScript that executes for every visitor of an affected page, including administrators.
Affected Products
- Tournamatch plugin for WordPress, all versions through 4.6.1
- WordPress sites allowing contributor-level or higher user registration
- Sites embedding the trn-ladder-registration-button shortcode in published content
Discovery Timeline
- 2025-05-23 - CVE-2025-4594 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-4594
Vulnerability Analysis
The vulnerability resides in the shortcode handler defined in includes/shortcodes/class-shortcodes.php. The trn-ladder-registration-button shortcode accepts attributes supplied by the content author. The plugin renders these attributes directly into the resulting HTML without applying esc_attr() or equivalent escaping. Because shortcodes are processed at render time, injected markup becomes part of the stored page and executes for every visitor.
WordPress grants contributor-level accounts the ability to create draft posts containing shortcodes. This lowers the barrier for exploitation on sites with open registration or multi-author workflows. When an editor or administrator previews or publishes the malicious content, the injected script runs with their session context.
Root Cause
The root cause is insufficient input sanitization and output escaping on shortcode attributes. The vulnerable code path is visible in the Tournamatch 4.6.1 source. Attribute values flow into the HTML response without being passed through WordPress escaping APIs such as esc_attr(), esc_html(), or wp_kses().
Attack Vector
An authenticated attacker with contributor privileges submits a post or page containing the trn-ladder-registration-button shortcode with a crafted attribute value. The attribute payload closes the surrounding HTML context and introduces a <script> tag or event handler such as onmouseover. Once the content is rendered, any visitor triggers the payload. Because the change of scope in the CVSS vector affects the browser origin, exploitation can pivot to administrator session compromise. See the Wordfence vulnerability analysis for additional context.
No public proof-of-concept exploit is currently listed for this CVE, and the vulnerability mechanism is described here in prose rather than with fabricated code.
Detection Methods for CVE-2025-4594
Indicators of Compromise
- Posts or pages containing the trn-ladder-registration-button shortcode with attributes that include <, >, ", or javascript: characters.
- Unexpected <script> tags or inline event handlers in rendered HTML for pages using Tournamatch shortcodes.
- Contributor accounts creating or editing posts that embed Tournamatch shortcodes with unusual attribute values.
Detection Strategies
- Query the WordPress wp_posts table for post_content matching the shortcode name combined with suspicious attribute patterns.
- Review web server access logs for pages that trigger outbound requests to attacker-controlled domains after being rendered.
- Compare deployed plugin files against the fixed upstream source in changeset 3295681.
Monitoring Recommendations
- Enable a Content Security Policy (CSP) that blocks inline scripts and log CSP violation reports.
- Alert on new contributor or author accounts followed by post creation containing shortcodes.
- Monitor administrator sessions for anomalous API calls originating from browser contexts after viewing user-generated content.
How to Mitigate CVE-2025-4594
Immediate Actions Required
- Update the Tournamatch plugin to a version later than 4.6.1 that includes the fix from changeset 3295681.
- Audit existing posts and pages for the trn-ladder-registration-button shortcode and inspect attribute values for injected markup.
- Rotate credentials for any administrator accounts that previewed contributor-authored content containing Tournamatch shortcodes.
Patch Information
The vendor addressed the vulnerability in the commit tracked as changeset 3295681, which introduces proper escaping of user-supplied shortcode attributes in class-shortcodes.php. Site operators should upgrade through the WordPress plugin update mechanism.
Workarounds
- Restrict contributor and author account creation until the plugin is updated.
- Temporarily deactivate the Tournamatch plugin on sites that cannot be patched immediately.
- Deploy a web application firewall (WAF) rule that blocks requests containing trn-ladder-registration-button shortcode attributes with HTML control characters.
# Configuration example: identify affected posts using WP-CLI
wp post list --post_status=any --format=ids \
| xargs -I{} wp post get {} --field=content \
| grep -n 'trn-ladder-registration-button'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
