CVE-2023-0220

CVE-2023-0220 affects the Pinpoint Booking System WordPress plugin prior to 2.9.9.2.9. The vulnerability arises from failing to validate/escape a shortcode attribute before using it in a SQL statement, enabling authenticated users with at least subscriber privileges to perform SQL Injection. Mult...

CVE-2015-9460

The CVE refers to CVE-2015-9460 in the WordPress Pinpoint/booking-system plugin. A SQL injection exists in the booking-system plugin before 2.1 via DOPBSPBackEndTranslation::display and the language parameter. Several connected records confirm the vulnerability, its association with the WordPress...

CVE-2024-13235

CVE-2024-13235 – Pinpoint Booking System (WordPress) SQL Injection : Authenticated attackers with Subscriber+ access can exploit SQL injection via the language parameter in Pinpoint Booking System plugins, affecting versions up to 2.9.9.5.x (CVE wording varies; Patchstack notes 2.9.9.5.4 as fixed...

CVE-2024-7112

The CVE-2024-7112 entry describes a SQL Injection in Pinpoint Booking System (WordPress plugin) via the schedule parameter, affecting versions up to and including 2.9.9.5.0. The vulnerability is exploitable by authenticated users with Subscriber+ privileges, enabling additional SQL queries to acc...

CVE-2023-45270

CVE-2023-45270 is a CSRF vulnerability in the WordPress Pinpoint Booking System plugin, affected versions

CVE-2023-25062

CVE-2023-25062 is a stored XSS vulnerability in Pinpoint Booking System for WordPress (plugin versions

CVE-2024-3636

The Pinpoint Booking System WordPress plugin, in versions prior to 2.9.9.4.8 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitise and escape certain settings before they are displayed on the page. This flaw allows high-privilege users, such as ...