Stored Cross-Site Scripting Vulnerability in Vagaro Booking Widget for WordPress
CVE-2026-3003
7.2HIGH
What is CVE-2026-3003?
The Vagaro Booking Widget for WordPress has a vulnerability that allows for Stored Cross-Site Scripting through the 'vagaro_code' parameter. This issue arises due to inadequate input sanitization and output escaping, permitting unauthorized users to inject malicious web scripts. When a user visits an impacted page, these scripts may execute, compromising the security and integrity of the site's content.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
Vagaro Booking Widget * <= 0.3