Pinpoint Booking System – Version 2

Pinpoint Booking System – Version 2 has 16 disclosed vulnerabilities in the WordSec catalog, reported between 2013 and 2026; 13 are fixed and 3 remain unpatched as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 4 high. 2024 was the busiest year with 5 disclosures.

The most common weakness is SQL Injection, behind 7 of the records (44%). Other recurring categories include Cross-Site Scripting, Cross-Site Request Forgery (CSRF).

13 of the records (81%) have a vendor fix, while 3 remain unpatched. The oldest unresolved one dates back to 2026.

12 independent researchers contributed these findings, most of them (2) reported by Muhammad Daffa.

Strategic Overview

Avg CVSSMedium

6.4/ 10

Patch Coverage81%

Open

Fixed

Get automatic notifications for all Pinpoint Booking System – Version 2 vulnerabilities before they are exploited.

Most severe open issueCVSS 5.3CVE-2026-12128

Pinpoint Booking System <= 2.9.9.6.8 - Unauthenticated Improper Input Validation to Price Manipulation via 'cart_data' Parameter

Read the full analysis

Vulnerability Records

16 records


2026-08-14 14:05	Pinpoint Booking System <= 2.9.9.6.8 - Unauthenticated Improper Input Validation to Price Manipulation via 'cart_data' Parameter Pinpoint Booking System <= 2.9.9.6.8	`CVE-2026-12128`	5.3 Medium	Enrico Marcolini	No
2026-07-31 12:40	Pinpoint Booking System <= 2.9.9.6.9 - Authenticated (Administrator+) SQL Injection via 'field' Parameter Pinpoint Booking System <= 2.9.9.6.9	`CVE-2026-15403`	4.9 Medium	Wordfence PRISM	No
2026-02-20 00:00	Pinpoint Booking System <= 2.9.9.6.5 - Missing Authorization Pinpoint Booking System <= 2.9.9.6.5	`CVE-2026-39678`	5.3 Medium	Quan Realme	No
2025-02-20 15:05	Pinpoint Booking System – #1 WordPress Booking Plugin <= 2.9.9.5.4 - Authenticated (Subscriber+) SQL Injection Pinpoint Booking System <= 2.9.9.5.4	`CVE-2024-13235`	6.5 Medium	Trương Hữu Phúc (truonghuuphuc)	Yes
2024-12-05 00:00	Pinpoint Booking System – #1 WordPress Booking Plugin <= 2.9.9.5.7 - Missing Authorization Pinpoint Booking System <= 2.9.9.5.7	`CVE-2024-54252`	6.3 Medium	Muhammad Daffa	Yes
2024-12-02 00:00	Pinpoint Booking System <= 2.9.9.5.1 - Authenticated (Subscriber+) SQL Injection Pinpoint Booking System <= 2.9.9.5.1	`CVE-2024-53815`	6.5 Medium	Trương Hữu Phúc (truonghuuphuc)	Yes
2024-10-15 00:00	Pinpoint Booking System <= 2.9.9.5.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting Pinpoint Booking System <= 2.9.9.5.7	`CVE-2024-49304`	6.1 Medium	Muhammad Daffa	Yes
2024-09-06 23:03	Pinpoint Booking System <= 2.9.9.5.0- Authenticated (Subscriber+) SQL Injection Pinpoint Booking System <= 2.9.9.5.0	`CVE-2024-7112`	8.8 High	Piotr Kuśpit	Yes
2024-07-15 00:00	Pinpoint Booking System <= 2.9.9.4.7 - Authenticated (Admin+) Stored Cross-Site Scripting Pinpoint Booking System <= 2.9.9.4.7	`CVE-2024-3636`	4.4 Medium	cyc707	Yes
2023-10-06 00:00	Pinpoint Booking System <= 2.9.9.4.0 - Cross-Site Request Forgery via initBackEndAJAX Pinpoint Booking System <= 2.9.9.4.0	`CVE-2023-45270`	5.4 Medium	Kévin Mosbahi (Mika)	Yes

Showing 1–10 of 16 reports