CVE-2023-0768

PoC —

CVSS 3.1

8.8 high

EPSS

<1%p57

Published

May 8, 2023 (May 8, 2023)

Modified

Jun 17, 2026

Description

The Avirato hotels online booking engine WordPress plugin through 5.0.5 does not validate and escape some of its shortcode attributes before using them in SQL statement/s, which could allow any authenticated users, such as subscriber to perform SQL Injection attacks.

Vendors: avirato
Products: hotels online booking engine
Ecosystems: WordPress
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.9%)

In the news0 stories

No ingested article mentions this CVE yet.