Cyber Resilience

CVE-2026-2231

High

Published: 26 March 2026

Published
26 March 2026
Modified
24 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
EPSS Score 0.0005 15.2th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-2231 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 15.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).

Deeper analysis

CVE-2026-2231 is a stored cross-site scripting (XSS) vulnerability in the Fluent Booking plugin for WordPress, affecting all versions up to and including 2.0.01. The issue arises from insufficient input sanitization and output escaping on multiple parameters (CWE-79), allowing arbitrary web scripts to be injected into pages.

Unauthenticated attackers can exploit this vulnerability remotely with low attack complexity, no privileges, and no user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base score 7.2). By submitting malicious payloads via the vulnerable parameters, attackers can store scripts that execute in users' browsers whenever an affected page is accessed.

The provided references link to specific locations in the plugin's source code where the vulnerabilities occur, including app/Hooks/Handlers/FrontEndHandler.php at line 864, app/Models/Booking.php at lines 440 and 448, and app/Services/LocationService.php at lines 110 and 115. No patch or mitigation details are specified in the available information.

EU & UK References

Vulnerability details

The Fluent Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in all versions up to, and including, 2.0.01 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject…

more

arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CWE(s)
CWE-79

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.007 JavaScript Execution
Adversaries may abuse various implementations of JavaScript for execution.
attack.mitre.org →
Why these techniques?

Stored XSS directly enables exploitation of public-facing web apps (T1190) and arbitrary JavaScript execution in victim browsers (T1059.007).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2026-3231Shared CWE-79
CVE-2025-23481Shared CWE-79
CVE-2025-69302Shared CWE-79
CVE-2025-23734Shared CWE-79
CVE-2025-23571Shared CWE-79
CVE-2025-65110Shared CWE-79
CVE-2026-24948Shared CWE-79
CVE-2025-27352Shared CWE-79
CVE-2025-30349Shared CWE-79
CVE-2026-3876Shared CWE-79

Affected Assets

Wordpress
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly addresses insufficient input sanitization by requiring validation at input points to block malicious script injection in the WordPress plugin parameters.

SI-15 Information Output Filtering good match
prevent

Mitigates lack of output escaping by filtering injected scripts before they are rendered in users' browsers on affected pages.

SI-2 Flaw Remediation good match
prevent

Requires identification, reporting, and correction of the specific stored XSS flaw in the Fluent Booking plugin source code locations.

References