Vagaro Booking Widget <= 0.3 - Unauthenticated Stored Cross-Site Scripting via 'vagaro_code'

Successful exploitation of CVE-2026-3003 allows an attacker to inject and execute malicious JavaScript code within the context of the Vagaro Booking Widget. This can lead to a variety of attacks, including stealing user cookies, redirecting users to phishing sites, or modifying the appearance of the website. The attacker could potentially gain access to user accounts if they are tricked into entering sensitive information on a malicious page. The blast radius extends to any user who interacts with the vulnerable booking widget, regardless of their role or privileges.

Websites utilizing the Vagaro Booking Widget plugin, particularly those with limited security hardening or those hosting shared WordPress instances, are at increased risk. Sites where the booking widget is prominently displayed or handles sensitive user data are especially vulnerable.

• wordpress / composer / npm:

grep -r 'vagaro_code' /var/www/html/wp-content/plugins/vagaro-booking-widget/

• wordpress / composer / npm:

wp plugin list | grep 'vagaro-booking-widget'

• wordpress / composer / npm:

wp plugin status | grep 'vagaro-booking-widget'

1. 2026-03-21Disclosure

   disclosure

1. 予約済み2026-02-23
2. 公開日2026-03-21
3. 更新日2026-04-08
4. EPSS 更新日2026-03-28

The primary mitigation for CVE-2026-3003 is to upgrade the Vagaro Booking Widget plugin to a version containing the security fix. If upgrading is not immediately possible, consider temporarily disabling the plugin to prevent further exploitation. While a direct WAF rule is difficult to implement without knowing the specific injection patterns, carefully reviewing and sanitizing any user-supplied input to the 'vagaro_code' parameter is crucial. Monitor WordPress access logs for unusual activity or suspicious requests targeting the plugin’s endpoints.

アクティブインストール数

600

プラグイン評価