This vulnerability (CVE-2026-57638) is classified as CWE-79, indicating improper neutralization of input during web page generation leading to cross-site scripting (XSS). It affects Fluent Booking versions up to 2.1.0. The vulnerability requires network access, low attack complexity, low privileges, and user interaction. It impacts confidentiality, integrity, and availability to a limited extent. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

Successful exploitation could allow an attacker with contributor-level privileges and requiring user interaction to execute arbitrary scripts in the context of the affected application. This could lead to limited confidentiality, integrity, and availability impacts as indicated by the CVSS vector. However, no active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit contributor privileges and monitor for suspicious activity related to script injection. Avoid clicking on untrusted links or content within the application that could trigger the vulnerability.