What is the CVSS score of CVE-2026-2231?

CVE-2026-2231 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of WordPress are affected by CVE-2026-2231?

WordPress sites using Fluent Booking plugin version 2.0.01 and earlier are vulnerable to stored script injection attacks that can compromise visitor browsers and steal sensitive data whenever…

How to fix or mitigate CVE-2026-2231?

Within 24 hours: Disable the Fluent Booking plugin or restrict access to booking forms via Web Application Firewall rules that block script injection patterns in form parameters. Within 7 days: Inventory all WordPress installations using Fluent Booking versions up to 2.0.01 and audit booking pages for evidence of injected scripts in database records and page content. Within 30 days: Upgrade to Fluent Booking version 2.0.02 or later once released by vendor, or replace plugin with alternative booking solution if no patch timeline is provided by the vendor.

WordPress CVE-2026-2231

EUVD-2026-16172 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-03-26 Wordfence

GHSA-j5rh-qm82-j48c

WordPress XSS

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 26, 2026 - 13:45 euvd

EUVD-2026-16172

Analysis Generated

Mar 26, 2026 - 13:45 vuln.today

CVE Published

Mar 26, 2026 - 13:26 nvd

HIGH 7.2

DescriptionCVE.org

The Fluent Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in all versions up to, and including, 2.0.01 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Unauthenticated attackers can inject malicious scripts into Fluent Booking plugin for WordPress versions up to 2.0.01, enabling Stored Cross-Site Scripting attacks that execute in victim browsers whenever injected pages are accessed. The vulnerability stems from insufficient input sanitization across multiple parameters in LocationService.php, Booking.php, and FrontEndHandler.php. With a CVSS score of 7.2 and network-based attack vector requiring no privileges, this represents a significant threat to WordPress sites using the affected booking plugin. No public exploit identified at time of analysis, and SSVC framework indicates no current exploitation with non-automatable attack profile.

Technical ContextAI

The vulnerability affects the Fluent Booking plugin (CPE: cpe:2.3:a:techjewel:fluent_booking_-_the_ultimate_appointments_scheduling,_events_booking,_events_calendar_solution:*:*:*:*:*:*:*:*), a WordPress appointment scheduling and events calendar solution. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically affecting multiple files including app/Services/LocationService.php (lines 115, 110), app/Models/Booking.php (lines 448, 440), and app/Hooks/Handlers/FrontEndHandler.php (line 864). The plugin fails to properly sanitize user-supplied input and escape output when rendering booking-related data, allowing script injection that persists in the database. This Stored XSS variant is more dangerous than reflected XSS because malicious payloads are permanently stored and execute for every user viewing the compromised pages, creating persistent attack surfaces across the WordPress installation.

RemediationAI

Upgrade Fluent Booking plugin to version 2.0.02 or later, which incorporates fixes released in changeset 3463540 available at https://plugins.trac.wordpress.org/changeset/3463540/. WordPress administrators should update immediately through the WordPress admin dashboard or manually download the patched version from the official WordPress plugin repository. Until patching is complete, consider temporarily disabling the Fluent Booking plugin on internet-facing WordPress installations or implementing Web Application Firewall (WAF) rules to filter potential XSS payloads in booking-related parameters. Review existing booking entries and calendar data for suspicious script content that may have been injected prior to patching. Consult the full technical advisory from Wordfence at https://www.wordfence.com/threat-intel/vulnerabilities/id/37441cc0-c43c-40e4-a170-1be59e112272?source=cve for additional security guidance and affected parameter details.