CVE-2023-0768

The Avirato hotels online booking engine WordPress plugin through 5.0.5 does not validate and escape some of its shortcode attributes before using them in SQL statement/s, which could allow any authenticated users, such as subscriber to perform SQL Injection attacks.

Score
CVSS 3.1 8.8 High
Status
Modified - contact@wpscan.com
Published
2023-05-08
Last modified
2025-01-29

Affected products

References

 
 
© AVABIS GmbH privacypolicy about