CVE-2024-5644: 
WordPress vulnerability analysis and mitigation

CVE-2024-5644 affects the Tournamatch WordPress plugin versions before 4.6.1. The vulnerability was discovered and disclosed on July 13, 2024, and involves improper sanitization and escaping of settings in the plugin (WPScan).

The vulnerability is a Stored Cross-Site Scripting (XSS) issue that affects high-privilege users such as administrators. The vulnerability exists because the plugin does not properly sanitize and escape some of its settings, allowing for XSS attacks even when the unfiltered_html capability is disallowed, such as in multisite setups. The vulnerability has been assigned a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:L (NVD).

The vulnerability allows high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks. This could potentially lead to client-side code execution in the context of other users' browsers when they view affected pages (WPScan).

A proof of concept exists demonstrating the exploitation path: 1) Navigate to /wp-admin/admin.php?page=trn-ladders-new, 2) Add a payload like 'test">alert(123)' to the 'Name' field, 3) Save and observe the XSS execution when the page reloads (WPScan).

The vulnerability has been fixed in version 4.6.1 of the Tournamatch plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).