The flaw is a classic Cross Site Scripting (XSS) vulnerability in the Fluent Booking plugin for WordPress, classified as CWE‑79. The plugin fails to properly validate or escape data supplied by a contributor, allowing an attacker to inject malicious script that will run in the browsers of anyone who views the affected page. Such injected script can be used to hijack user sessions, steal credentials, or deface content.

WordPress sites that have installed the Fluent Booking plugin version 2.1.0 or earlier. The vulnerability is specific to the file handling or display functions coded by WPManageNinja LLC. Any deployment that has not updated to 2.1.1 or newer remains susceptible.

The CVSS base score of 6.5 indicates a medium severity exposure. The EPSS score is not available, so the overall probability of exploitation cannot be precisely quantified, but the lack of a KEV listing suggests no widespread active exploitation is documented. The attacker would need to supply malicious input through the booking interface or contributor access, which is likely reachable publicly or via authenticated users, making the attack path feasible if the site operates the vulnerable plugin.