Fluent Booking The Ultimate Appointments Scheduling Events Booking Events Calendar Solution
EUVD-2026-16172
|
CVE-2026-2231
HIGH
GHSA-j5rh-qm82-j48c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious input with JavaScript payload
-
ExploitSubmit unsanitized data via vulnerable plugin parameters
-
ExecutionStore payload in WordPress database
-
ImpactExecute script when users access injected pages
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires WordPress installation with Fluent Booking plugin version 2.0.01 or earlier enabled. Unauthenticated remote attacker injects malicious scripts via vulnerable parameters. Stored payload executes when any user accesses the injected page—no victim interaction required beyond normal site browsing. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) indicates a network-exploitable vulnerability with low attack complexity requiring no privileges or user interaction, with changed scope and low confidentiality and integrity impact. However, real-world risk assessment reveals moderate urgency: SSVC framework shows no current exploitation, non-automatable attacks, and partial technical impact. The unauthenticated attack vector (PR:N) is concerning for internet-facing WordPress sites, but the absence of EPSS probability data, no CISA KEV listing, and no public exploit code suggests limited active threat activity. The changed scope (S:C) elevates severity as injected scripts can affect resources beyond the vulnerable component. While the CVSS score of 7.2 appears high, the combination of no observed exploitation, partial impact, and availability of patches through changeset 3463540 suggests this is a priority for WordPress administrators but not an emergency requiring immediate emergency response compared to actively exploited vulnerabilities. |
| Exploit ScenarioDerived | An unauthenticated attacker submits a booking request through the Fluent Booking plugin interface, injecting malicious JavaScript code into location fields or booking parameters that are inadequately sanitized by LocationService.php or Booking.php. When site administrators or other users view the booking details, calendar entries, or event listings, the stored XSS payload executes in their browsers, potentially stealing session cookies, performing actions on behalf of victims, or redirecting users to phishing pages. The low attack complexity and no user interaction requirement (UI:N) means automated scanning tools could identify vulnerable installations and inject payloads without social engineering, though no public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 26, 2026
Unauthenticated attackers can inject malicious scripts into Fluent Booking plugin for WordPress versions up to 2.0.01, enabling Stored Cross-Site Scripting attacks that execute in victim browsers whenever injected pages are accessed. The vulnerability stems from insufficient input sanitization across multiple parameters in LocationService.php, Booking.php, and FrontEndHandler.php. With a CVSS score of 7.2 and network-based attack vector requiring no privileges, this represents a significant threat to WordPress sites using the affected booking plugin. No public exploit identified at time of analysis, and SSVC framework indicates no current exploitation with non-automatable attack profile.
RemediationAI
Upgrade Fluent Booking plugin to version 2.0.02 or later, which incorporates fixes released in changeset 3463540 available at https://plugins.trac.wordpress.org/changeset/3463540/. WordPress administrators should update immediately through the WordPress admin dashboard or manually download the patched version from the official WordPress plugin repository. Until patching is complete, consider temporarily disabling the Fluent Booking plugin on internet-facing WordPress installations or implementing Web Application Firewall (WAF) rules to filter potential XSS payloads in booking-related parameters. Review existing booking entries and calendar data for suspicious script content that may have been injected prior to patching. Consult the full technical advisory from Wordfence at https://www.wordfence.com/threat-intel/vulnerabilities/id/37441cc0-c43c-40e4-a170-1be59e112272?source=cve for additional security guidance and affected parameter details.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability affects the Fluent Booking plugin (CPE: cpe:2.3:a:techjewel:fluent_booking_-_the_ultimate_appointments_scheduling,_events_booking,_events_calendar_solution:*:*:*:*:*:*:*:*), a WordPress appointment scheduling and events calendar solution. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically affecting multiple files including app/Services/LocationService.php (lines 115, 110), app/Models/Booking.php (lines 448, 440), and app/Hooks/Handlers/FrontEndHandler.php (line 864). The plugin fails to properly sanitize user-supplied input and escape output when rendering booking-related data, allowing script injection that persists in the database. This Stored XSS variant is more dangerous than reflected XSS because malicious payloads are permanently stored and execute for every user viewing the compromised pages, creating persistent attack surfaces across the WordPress installation.
Know when Fluent Booking The Ultimate Appointments Scheduling Events Booking Events Calendar Solution gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
The Fluent Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in all versions up to, and including, 2.0.01 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Executive ViewAI
WordPress sites using Fluent Booking plugin version 2.0.01 and earlier are vulnerable to stored script injection attacks that can compromise visitor browsers and steal sensitive data whenever affected pages are accessed. Any unauthenticated attacker can inject malicious content without authentication, creating persistent threats across all users who visit compromised booking forms or pages. Organizations relying on this plugin for customer interactions face potential data theft, credential compromise, and reputational damage until remediation is completed.
Implement WAF rules to block script injection patterns (script tags, event handlers) in booking form parameters including LocationService, Booking, and FrontEndHandler input fields. Restrict plugin access to authenticated users only if business logic permits. Monitor booking database tables for suspicious content modifications. Disable the plugin entirely until patch availability is confirmed. Segment booking functionality behind additional authentication layers. Regularly scan and audit stored content for malicious scripts using content security policy headers to prevent execution.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Exploit-DB