dotonpaper Pinpoint Booking System – Version 2 vulnerabilities

13 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 5 published in the last 12 months.

Latest dotonpaper Pinpoint Booking System – Version 2 vulnerabilities

CVE-2026-12128 — Pinpoint Booking System <= 2.9.9.6.8 - Unauthenticated Improper Input Validation to Price Manipulation via 'cart_data' Parameter (CVSS 5.3)
CVE-2026-15229 — Pinpoint Booking System <= 2.9.9.7.1 - Unauthenticated Arbitrary Booking Price Manipulation (CVSS 5.3)
CVE-2026-15403 — Pinpoint Booking System <= 2.9.9.6.9 - Authenticated (Administrator+) SQL Injection via 'field' Parameter (CVSS 4.9)
CVE-2024-13235 — Pinpoint Booking System – #1 WordPress Booking Plugin <= 2.9.9.5.4 - Authenticated (Subscriber+) SQL Injection (CVSS 6.5)
CVE-2024-54252 — WordPress Pinpoint Booking System Plugin <= 2.9.9.5.7 - Broken Access Control vulnerability (CVSS 6.3)
CVE-2024-49304 — WordPress Pinpoint Booking System plugin <= 2.9.9.5.7 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 5.4)
CVE-2024-7112 — Pinpoint Booking System <= 2.9.9.5.0- Authenticated (Subscriber+) SQL Injection (CVSS 6.5)
CVE-2024-3636 — Pinpoint Booking System < 2.9.9.4.8 - Admin+ Stored XSS (CVSS 5.4)
CVE-2023-38520 — WordPress Pinpoint Booking System plugin <= 2.9.9.3.4 - Parameter Tampering (CVSS 6.5)
CVE-2023-45270 — WordPress Pinpoint Booking System Plugin <= 2.9.9.4.0 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 8.8)
CVE-2023-25062 — WordPress Pinpoint Booking System Plugin <= 2.9.9.2.8 is vulnerable to Cross Site Scripting (XSS) (CVSS 4.8)
CVE-2023-0220 — Pinpoint Booking System < 2.9.9.2.9 - Subscriber+ SQLi (CVSS 8.8)
CVE-2015-9460 — (CVSS 8.8)