techjewel Vulnerabilities and Affected Products
Vulnerabilities associated with Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution.
Products
Clear product- Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder25 vulnerabilities
- Fluent Forms Pro Add On Pack5 vulnerabilities
- Ninja Tables – Easy Data Table Builder4 vulnerabilities
- FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution3 vulnerabilities
- Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution2 vulnerabilities
- FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider2 vulnerabilities
- Fluent Support – Helpdesk & Customer Support Ticket System1 vulnerability
- FluentAuth – The Ultimate Authorization & Security Plugin for WordPress1 vulnerability
- WP GDPR Cookie Consent1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-2231HIGH | Fluent Booking <= 2.0.01 - Unauthenticated Stored Cross-Site Scripting via Multiple ParametersThe Fluent Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in all versions up to, and including, 2.0.01 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CWE-79Mar 26, 2026 | CVSS7.2v3.1 | EPSS0.302% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-13756MEDIUM | Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution <= 1.9.11 - Authenticated (Subscriber+) Missing Authorization to Calendar Import and ManagementThe Fluent Booking plugin for WordPress is vulnerable to unauthorized calendar import and management due to a missing capability check on the "importCalendar" function in all versions up to, and including, 1.9.11. This makes it possible for authenticated attackers, with subscriber level access and above, to import arbitrary calendars and manage them. CWE-862Dec 3, 2025 | CVSS4.3v3.1 | EPSS0.184% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |