CVE-2026-2231 is a stored cross-site scripting vulnerability in the Fluent Booking plugin for WordPress, affecting all versions up to and including 2.0.01. The issue arises from insufficient sanitization and escaping of multiple input parameters, enabling unauthenticated attackers to inject arbitrary web scripts. These scripts execute in the context of users visiting the affected pages, potentially leading to data theft or session hijacking. The vulnerability has a CVSS 3.1 base score of 7.2, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality and integrity with scope change.

Successful exploitation allows unauthenticated attackers to inject and execute arbitrary scripts in the context of users viewing the affected pages. This can lead to disclosure of sensitive information, session hijacking, or other malicious actions performed with the privileges of the victim user. There is no indication of impact on availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider applying temporary mitigations such as disabling the plugin or restricting access to affected pages. Monitor vendor channels for updates and apply patches promptly once available.