Executive summary

A stored Cross-Site Scripting (XSS) vulnerability in the Vagaro Booking Widget WordPress plugin (versions ≤ 0.3) has been assigned CVE-2026-3003. An unauthenticated attacker can submit HTML/JavaScript into a plugin field named vagaro_code, which is then stored and later rendered in pages or admin screens. Because the payload is stored, it can execute repeatedly whenever a visitor or an administrative user views affected pages.

From a pragmatic security perspective, this is a medium-severity issue with real operational risk: stored XSS enables session theft, persistent redirection, privilege escalation (when combined with CSRF), and planting of persistent malware or backdoors. If an upstream patch is not yet available, site owners should act fast to contain and remediate.

This article explains the vulnerability, its impact, how to detect affected sites, and practical containment, remediation and hardening steps — written from the viewpoint of an experienced Hong Kong security practitioner.

Who should read this

• WordPress site owners using the Vagaro Booking Widget plugin.
• Developers and agencies maintaining client sites with the plugin installed.
• Security-aware administrators who must contain and remediate quickly.
• Hosting providers and managed WordPress teams who assist customers.

What is the vulnerability?

• Vulnerability type: Stored Cross-Site Scripting (XSS).
• Affected component: Vagaro Booking Widget (plugin) — versions ≤ 0.3.
• Affected field: user-supplied content saved in a plugin field named vagaro_code.
• Privilege required: Unauthenticated (any visitor can submit payloads).
• Impact: Persistent execution of attacker-supplied JavaScript in the browser context of site visitors and admins.
• CVE: CVE-2026-3003
• Disclosure date: 23 March 2026

Stored XSS stores malicious content on the server (database or persistent storage) and later serves it to users. An attacker does not need a crafted URL — simply viewing the affected page may trigger execution.

Why this is serious

• Persistence: Payloads remain until removed, repeatedly affecting visitors.
• Admin exposure: If an admin views the infected page, the payload runs with their privileges and can modify site configuration or content.
• Automation & scale: Stored XSS can be used to deploy backdoors, create admin users, or serve malware across many pages.
• Evasion: Payloads can be obfuscated to evade simple scanners; plugin-specific inputs may be overlooked during routine checks.

Typical exploitation scenarios

• Exfiltrate authentication cookies or tokens, enabling account takeover.
• Inject cryptominer or ad-fraud scripts visible to all visitors.
• Create admin accounts or insert options that persist a server-side loader.
• Redirect visitors to phishing or malware sites.
• Chain with CSRF or weak credentials to fully compromise a site or pivot to other systems.

Safe technical overview (no exploit code)

1. Attacker submits HTML/JS into the plugin input that stores vagaro_code.
2. The plugin stores the value without proper sanitization or output encoding.
3. When a page or admin screen renders the stored value, the browser executes the JavaScript in the site context.
4. The payload runs with the privilege level of the viewer and can perform actions or exfiltrate data.

No exploit code is reproduced here. The focus is detection, containment, and remediation.

How to quickly check if your site is affected

Important: Take a full backup (files + database) before making changes. If you suspect compromise, isolate the site and work from a safe environment.

1. Identify whether the plugin is installed and its version:
   • WordPress admin: Plugins → Installed Plugins → look for “Vagaro Booking Widget”.
   • WP-CLI: wp plugin list --status=active
2. Search for plugin-specific database fields that may hold vagaro_code. Example SQL queries (run via phpMyAdmin, Adminer, or wp db query):

SELECT * FROM wp_postmeta WHERE meta_value LIKE '%vagaro_code%' OR meta_key LIKE '%vagaro%';
SELECT * FROM wp_options WHERE option_name LIKE '%vagaro%' OR option_value LIKE '%

wp db query "SELECT * FROM wp_postmeta WHERE meta_value LIKE '%