VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

Pinpoint Booking System – Legacy version security & vulnerabilities

booking-system— active installsLast vulnerability Aug 14, 2026

Unpatched vulnerability in the latest version

At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.

Watch plugin
17Known vulnerabilities
  • Critical0
  • High4
  • Medium13
  • Low0
Vulnerabilities per year
2013: 1 vulnerability1132014: 1 vulnerability1142015: 1 vulnerability1152023: 4 vulnerabilities4232024: 5 vulnerabilities5242025: 1 vulnerability1252026: 4 vulnerabilities426

All Pinpoint Booking System – Legacy version vulnerabilities

Pinpoint Booking System – Legacy version vulnerabilities
SeverityVulnerabilityCVEPublished
Medium5.3Unauthenticated Improper Input Validation to Price Manipulation via 'cart_data' Parameter
≤2.9.9.6.9Update to 2.9.9.7.0
CVE-2026-12128
Medium5.3Missing Authorization to Unauthenticated Arbitrary Booking Price Manipulation
≤2.9.9.7.1Update to 2.9.9.7.2
CVE-2026-15229
Medium4.9Authenticated (Administrator+) SQL Injection via 'field' Parameter
≤2.9.9.6.9Update to 2.9.9.7.0
CVE-2026-15403
Medium5.3Missing Authorization
≤2.9.9.6.5No patch available
CVE-2026-39678
Medium6.5Authenticated (Subscriber+) SQL Injection
≤2.9.9.5.4Update to 2.9.9.6.0
CVE-2024-13235
Medium6.3Missing Authorization
≤2.9.9.5.7Update to 2.9.9.5.8
CVE-2024-54252
Medium6.5Authenticated (Subscriber+) SQL Injection
≤2.9.9.5.1Update to 2.9.9.5.2
CVE-2024-53815
Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting
≤2.9.9.5.7Update to 2.9.9.5.8
CVE-2024-49304
High8.8Pinpoint Booking System <= 2.9.9.5.0- Authenticated (Subscriber+) SQL Injection
≤2.9.9.5.0Update to 2.9.9.5.1
CVE-2024-7112
Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
≤2.9.9.4.7Update to 2.9.9.4.8
CVE-2024-3636
Medium5.4Cross-Site Request Forgery via initBackEndAJAX
≤2.9.9.4.0Update to 2.9.9.4.1
CVE-2023-45270
Medium5.3Content Spoofing
≤2.9.9.3.4Update to 2.9.9.3.5
CVE-2023-38520
Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
<2.9.9.2.9Update to 2.9.9.2.9
CVE-2023-25062
High8.8Authenticated (Subscriber+) SQL Injection
≤2.9.9.2.8Update to 2.9.9.2.9
CVE-2023-0220
High8.8Authenticated SQL Injection
<2.1Update to 2.1
CVE-2015-9460
High8.8SQL Injection
<1.3Update to 1.3
CVE-2014-3210
Medium6.1Reflected Cross-Site Scripting
≤1.3.1Update to 1.4
—

Pinpoint Booking System – Legacy version: common questions

Does Pinpoint Booking System – Legacy version have known vulnerabilities?

Yes. VulnCrest Radar lists 17 known vulnerabilities in Pinpoint Booking System – Legacy version: 4 high, 13 medium. At least one is not fixed in the latest version.

How do I check which version of Pinpoint Booking System – Legacy version I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent Pinpoint Booking System – Legacy version vulnerability?

CVE-2026-12128, published Aug 14, 2026: Pinpoint Booking System <= 2.9.9.6.9 - Unauthenticated Improper Input Validation to Price Manipulation via 'cart_data' Parameter. Severity: Medium (CVSS 5.3).

Is any Pinpoint Booking System – Legacy version vulnerability listed in CISA KEV?

No. None of the known Pinpoint Booking System – Legacy version vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?