Dotonpaper

10 CVEs across 4 Dotonpaper products. Browse Dotonpaper vulnerabilities, severities, and proof-of-concept exploits.

Dotonpaper products with known CVEs

ProductCVEs
Pinpoint Booking System4
Pinpoint Booking System – Version 24
Booking System1
Dot On Paper Shortcodes1
Dotonpaper CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-12128Medium5.32026-08-15The Pinpoint Booking System – Version 2 plugin for WordPress is vulnerable to Price Manipulation via the `cart_data` parameter in all versions up to, and inclu…
CVE-2026-15403Medium4.92026-08-01The Pinpoint Booking System – Version 2 plugin for WordPress is vulnerable to blind SQL Injection via the 'field' parameter in all versions up to, and includin…
CVE-2026-39678Medium5.32026-04-08Missing Authorization vulnerability in DOTonPAPER Pinpoint Booking System booking-system allows Exploiting Incorrectly Configured Access Control Security Level…
CVE-2024-13235Medium6.52025-02-21The Pinpoint Booking System – #1 WordPress Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the 'language' parameter in all versions up t…
CVE-2024-54252Medium6.32024-12-13Missing Authorization vulnerability in DOTonPAPER Pinpoint Booking System booking-system allows Exploiting Incorrectly Configured Access Control Security Level…
CVE-2024-53815High8.52024-12-06Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DOTonPAPER Pinpoint Booking System booking-system allows…
CVE-2024-49304Medium5.42024-10-17Cross-Site Request Forgery (CSRF) vulnerability in DOTonPAPER Pinpoint Booking System booking-system allows Stored XSS.This issue affects Pinpoint Booking Syst…
CVE-2024-7112High8.82024-09-07The Pinpoint Booking System – #1 WordPress Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the ‘schedule’ parameter in all versions up t…
CVE-2024-4377Medium5.42024-06-21The DOP Shortcodes WordPress plugin through 1.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where…
CVE-2014-32102014-05-22SQL injection vulnerability in dopbs-backend-forms.php in the Booking System (Booking Calendar) plugin before 1.3 for WordPress allows remote authenticated use…