Vulnerabilities

TI-2024-12279 CVE-2024-13235 · GHSA-j72w-qg22-3234

Pinpoint Booking System – #1 WordPress Booking Plugin <= 2.9.9.5.4 - Authenticated (Subscriber+) SQL Injection

LOW 29

The Pinpoint Booking System – #1 WordPress Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the 'language' parameter in all versions up to, and including, 2.9.9.5.4 due to insufficient escaping on t…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00389 Published 2025-02-21 No fix listed CWE-89

TI-2024-06585 CVE-2024-7112 · GHSA-p64c-2wr6-h7wf

Pinpoint Booking System <= 2.9.9.5.0- Authenticated (Subscriber+) SQL Injection

MEDIUM 41

The Pinpoint Booking System – #1 WordPress Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the ‘schedule’ parameter in all versions up to, and including, 2.9.9.5.0 due to insufficient escaping on t…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00504 Published 2024-09-07 No fix listed CWE-89

TI-2024-03391 CVE-2024-3636 · GHSA-mp55-qmj4-xm5f

Pinpoint Booking System < 2.9.9.4.8 - Admin+ Stored XSS

MEDIUM 58

The Pinpoint Booking System WordPress plugin before 2.9.9.4.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even wh…

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00369 Published 2024-08-05 Fixed in 2.9.9.4.8 CWE-79

TI-2023-24260 CVE-2023-45270 · GHSA-456w-4cfv-54mf

WordPress Pinpoint Booking System Plugin <= 2.9.9.4.0 is vulnerable to Cross Site Request Forgery (CSRF)

LOW 38

Cross-Site Request Forgery (CSRF) vulnerability in PINPOINT.WORLD Pinpoint Booking System plugin <= 2.9.9.4.0 versions.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00256 Published 2023-10-13 No fix listed CWE-352

TI-2023-10534 CVE-2023-25062 · GHSA-mc75-5rc8-w275

WordPress Pinpoint Booking System Plugin <= 2.9.9.2.8 is vulnerable to Cross Site Scripting (XSS)

LOW 27

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PINPOINT.WORLD Pinpoint Booking System plugin <= 2.9.9.2.8 versions.

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00509 Published 2023-04-06 No fix listed CWE-79

TI-2023-00212 CVE-2023-0220 · GHSA-3wg8-6w7g-gg2j

Pinpoint Booking System < 2.9.9.2.9 - Subscriber+ SQLi

HIGH 73

The Pinpoint Booking System WordPress plugin before 2.9.9.2.9 does not validate and escape one of its shortcode attributes before using it in a SQL statement, which could allow any authenticated users, such as subscriber…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00937 Published 2023-02-13 Fixed in 2.9.9.2.9

TI-2015-07837 CVE-2015-9460 · GHSA-7fvr-p398-mhjp

The booking-system plugin before 2.1 for WordPress has DOPBSPBackEndTranslation::display…

MEDIUM 42

The booking-system plugin before 2.1 for WordPress has DOPBSPBackEndTranslation::display SQL injection via the language parameter.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01927 Published 2019-10-10 No fix listed CWE-89