What is the CVSS score of CVE-2026-3003?

CVE-2026-3003 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of Vagaro Booking Widget are affected by CVE-2026-3003?

An unauthenticated attacker can inject malicious code into the Vagaro Booking Widget plugin that executes for all site visitors, enabling credential theft and session hijacking.

How to fix or mitigate CVE-2026-3003?

Within 24 hours: Audit all WordPress sites for Vagaro Booking Widget installation and disable the plugin immediately if present; review access logs for exploitation signs. Within 7 days: If the booking widget is business-critical, implement WAF rules blocking the 'vagaro_code' parameter and isolate the plugin behind authentication; engage Vagaro for patch timeline. Within 30 days: Either apply the vendor patch once released or replace the plugin with a hardened alternative; conduct credential audit and session review for affected users.

Vagaro Booking Widget CVE-2026-3003

EUVD-2026-14185 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-03-21 Wordfence

GHSA-jrx3-5v7w-9rrh

WordPress XSS Vagaro Booking Widget Wordpress Plugin

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2026-14185

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:26 nvd

HIGH 7.2

DescriptionCVE.org

The Vagaro Booking Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘vagaro_code’ parameter in all versions up to, and including, 0.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

The Vagaro Booking Widget plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the 'vagaro_code' parameter affecting all versions up to and including 0.3. Unauthenticated attackers can inject malicious JavaScript that executes whenever any user visits the compromised page, potentially leading to session hijacking, credential theft, or further site compromise. The CVSS score of 7.2 reflects network-based exploitation with no authentication required and changed scope, indicating the attack can affect resources beyond the vulnerable component.

Technical ContextAI

This vulnerability affects the Vagaro Booking Widget WordPress plugin, identified by CPE cpe:2.3:a:vagaro:vagaro_booking_widget:*:*:*:*:*:*:*:*. The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically in the handling of the 'vagaro_code' parameter. The plugin fails to implement adequate input sanitization and output escaping on lines 104 and 230 of vagaro-booking-widget.php, allowing raw user input to be stored in the database and rendered directly into HTML output. This is a classic Stored XSS vulnerability where malicious payloads persist in the application's data store and are served to all subsequent visitors, making it more severe than reflected XSS variants.

RemediationAI

WordPress site administrators should immediately update the Vagaro Booking Widget plugin to a version later than 0.3 that addresses this vulnerability, checking for available updates through the WordPress admin dashboard or the official WordPress plugin repository. If no patched version is available or immediate updating is not feasible, administrators should deactivate and remove the plugin until a secure version is released. As an additional hardening measure, implement Web Application Firewall (WAF) rules to filter potential XSS payloads in the 'vagaro_code' parameter and enable Content Security Policy (CSP) headers to mitigate XSS impact by restricting script execution to trusted sources. Refer to the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/7a480473-ceae-4621-9b13-e0f0543c57e3?source=cve for additional context and monitor the plugin's changelog for security updates.