CVE-2026-3003 is a stored cross-site scripting vulnerability in the Vagaro Booking Widget WordPress plugin, affecting all versions up to 0.3. The issue stems from improper neutralization of input in the 'vagaro_code' parameter, enabling unauthenticated attackers to inject malicious scripts that execute in the context of users visiting the compromised pages. The vulnerability has a CVSS 3.1 base score of 7.2 (High), with network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality and integrity with no availability impact.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of users visiting pages containing the injected code. This can lead to theft of sensitive information, session hijacking, or other malicious actions affecting user confidentiality and integrity. There is no indication of availability impact or known active exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the Vagaro Booking Widget plugin if feasible. Applying web application firewall (WAF) rules to detect and block malicious input targeting the 'vagaro_code' parameter may provide temporary mitigation.