What is the CVSS score of CVE-2026-57638?

CVE-2026-57638 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Fluent Booking CVE-2026-57638

EUVD-2026-39754 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-26 audit@patchstack.com

GHSA-xqj2-5xg4-w8vj

WordPress XSS Wordpress Plugin

6.5

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

5.4 MEDIUM

Contributor authentication (PR:L) and mandatory admin interaction (UI:R) bound the attack surface; scope changes into victim browser session; no credible availability impact from XSS justifies removing A:L.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 16:12 vuln.today

DescriptionCVE.org

Contributor Cross Site Scripting (XSS) in Fluent Booking <= 2.1.0 versions.

AnalysisAI

Stored cross-site scripting in the Fluent Booking WordPress plugin (versions up to and including 2.1.0) enables authenticated contributors to inject arbitrary JavaScript into booking-related content that executes in the browser of any higher-privileged user who reviews or views that content. The CVSS Scope:Changed metric confirms the payload escapes the contributor's low-privilege context and compromises the browser session of editors or administrators, enabling session hijacking or unauthorized privileged actions. No public exploit code or CISA KEV listing exists at time of analysis, but the vulnerability was confirmed and disclosed by Patchstack.

Technical ContextAI

Fluent Booking is a WordPress appointment-scheduling and booking management plugin. CWE-79 (Improper Neutralization of Input During Web Page Generation) describes a failure to sanitize or encode user-supplied input before it is rendered as HTML in a browser - the root cause here. WordPress's Contributor role is intentionally restricted: contributors can draft content but cannot publish without review, making contributor-accessible input fields a classic XSS escalation path when not sanitized, since those fields are typically reviewed by higher-privileged users. The CVSS S:C (Scope Changed) metric is significant: it means the injected script crosses the browser's same-origin context from the contributor's session into the victim's authenticated session. Affected product is identified via ENISA EUVD-2026-39754 as Fluent Booking plugin version 2.1.0 and below; no CPE string was included in the source intelligence.

RemediationAI

Update Fluent Booking to the first release above version 2.1.0 that addresses this XSS; the exact fix version must be confirmed via the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/fluent-booking/vulnerability/wordpress-fluent-booking-plugin-2-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve) or the WordPress plugin repository changelog, as no confirmed patch version is stated in the available intelligence. As a compensating control while awaiting a patch, restrict the WordPress Contributor role to fully trusted accounts only, removing any anonymous or loosely-controlled registration pathways that grant contributor access - note this may impact editorial workflows. Additionally, deploying a WordPress-aware web application firewall (WAF) rule to filter JavaScript injection patterns in plugin input fields can reduce exposure without disabling the plugin entirely. If the plugin is non-essential, temporary deactivation eliminates the attack surface with no architectural side effects.