The booking-system plugin before 2.1 for WordPress has DOPBSPBackEndTranslation::display SQL injection via the language parameter.

Published Oct 10, 2019 · Updated Aug 6, 2024 · Assigned by mitre