The Fluent Booking plugin is susceptible to stored cross‑site scripting via multiple input fields that fail to sanitize or escape user content. This flaw permits an unauthenticated attacker to embed malicious scripts, which will be rendered and executed when any visitor loads the affected page. The weakness aligns with CWE‑79 and can compromise confidentiality, integrity, or availability by enabling session hijacking, phishing, or data exfiltration, as the injected code runs with the permissions of the visiting user.

Vendors: TechJewel. Product: Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution. All installed versions up to and including 2.0.01 are affected. Users running WordPress sites with this plugin should verify their version and apply updates accordingly.

The CVSS base score of 7.2 indicates a medium‑to‑high severity. The flaw is exploitable without authentication and can be triggered by any user who submits data to the vulnerable parameters, making it widely accessible. While EPSS data is unavailable, the nature of stored XSS coupled with its remote impact suggests a high likelihood of exploitation in practice. The vulnerability is not currently listed the CISA KEV catalog, but operators should treat it as a serious risk.