CVE-2026-3003: XSS in Vagaro Booking Widget

Successful exploitation of CVE-2026-3003 allows an attacker to inject and execute malicious JavaScript code within the context of the Vagaro Booking Widget. This can lead to a variety of attacks, including stealing user cookies, redirecting users to phishing sites, or modifying the appearance of the website. The attacker could potentially gain access to user accounts if they are tricked into entering sensitive information on a malicious page. The blast radius extends to any user who interacts with the vulnerable booking widget, regardless of their role or privileges.

1. Reserved2026-02-23
2. Published2026-03-21
3. Modified2026-04-08
4. EPSS updated2026-03-28

The primary mitigation for CVE-2026-3003 is to upgrade the Vagaro Booking Widget plugin to a version containing the security fix. If upgrading is not immediately possible, consider temporarily disabling the plugin to prevent further exploitation. While a direct WAF rule is difficult to implement without knowing the specific injection patterns, carefully reviewing and sanitizing any user-supplied input to the 'vagaro_code' parameter is crucial. Monitor WordPress access logs for unusual activity or suspicious requests targeting the plugin’s endpoints.

Active installs

600

Plugin rating