Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution <= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
medium
The Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wi...
- CVSS:
- 6.4
- Affected:
- up to 2.1.0
- Fixed in:
- 2.1.1
- Disclosed:
- Jun 26, 2026
CVE-2026-57638 on NVD →
Fluent Booking <= 2.1.1 - Authenticated (Calendar Manager+) Information Exposure
medium
The Fluent Booking plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.1.1. This is due to missing per-booking access verification on the attendee export endpoint, which only checked for a broad Calendar Manager role rather than validating the requesting user's acces...
- CVSS:
- 4.3
- Affected:
- up to 2.1.1
- Fixed in:
- 2.1.2
- Disclosed:
- Jun 9, 2026
CVE-2026-9576 on NVD →
Fluent Booking - Unauthenticated Stored Cross-Site Scripting via Multiple Parameters vulnerability
high
Unauthenticated Stored Cross-Site Scripting via Multiple Parameters vulnerability
- CVSS:
- 7.1
- Affected:
- up to 2.0.01
- Fixed in:
- 2.0.05
- Disclosed:
- Mar 30, 2026
Fluent Booking <= 2.0.01 - Unauthenticated Stored Cross-Site Scripting via Multiple Parameters
high
The Fluent Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in all versions up to, and including, 2.0.01 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will ex...
- CVSS:
- 7.2
- Affected:
- up to 2.0.01
- Fixed in:
- 2.0.05
- Disclosed:
- Mar 25, 2026
CVE-2026-2231 on NVD →
Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution [fluent-booking] <= 1.9.11 (unfixed)
unknown
[en] Missing Authorization vulnerability in Shahjahan Jewel Fluent Booking fluent-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fluent Booking: from n/a through <= 1.9.11.
- Affected:
- up to 1.9.11
- Fix:
- No patched version reported
- Disclosed:
- Dec 9, 2025
CVE-2025-67597 on NVD →
Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution <= 1.9.11 - Authenticated (Subscriber+) Missing Authorization to Calendar Import and Management
medium
The Fluent Booking plugin for WordPress is vulnerable to unauthorized calendar import and management due to a missing capability check on the "importCalendar" function in all versions up to, and including, 1.9.11. This makes it possible for authenticated attackers, with subscriber level access and above, to import arbi...
- CVSS:
- 4.3
- Affected:
- up to 1.9.11
- Fixed in:
- 1.10.0
- Disclosed:
- Dec 3, 2025
CVE-2025-13756 on NVD →
Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution [fluent-booking] < 1.10.0
unknown
[en] The Fluent Booking plugin for WordPress is vulnerable to unauthorized calendar import and management due to a missing capability check on the "importCalendar" function in all versions up to, and including, 1.9.11. This makes it possible for authenticated attackers, with subscriber level access and above, to import...
- Affected:
- up to 1.10.0
- Fixed in:
- 1.10.0
- Disclosed:
- Dec 3, 2025
CVE-2025-13756 on NVD →
Fluent Booking <= 1.9.11 - Missing Authorization
medium
The Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.9.11. This makes it possible for authenticated attackers, with Subscriber-...
- CVSS:
- 4.3
- Affected:
- up to 1.9.11
- Fixed in:
- 1.10.0
- Disclosed:
- Nov 25, 2025
CVE-2025-67597 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database