high8.8
CVE-2023-0220
The Pinpoint Booking System WordPress plugin before 2.9.9.2.9 does not validate and escape one of its shortcode attributes before using it in a SQL statement, …
Impact
The Pinpoint Booking System WordPress plugin before 2.9.9.2.9 does not validate and escape one of its shortcode attributes before using it in a SQL statement, which could allow any authenticated users, such as subscriber to perform SQL Injection attacks.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Pinpoint | Pinpoint Booking System | before 2.9.9.2.9 |