The Vagaro Booking Widget plugin for WordPress is vulnerable to stored cross-site scripting, which allows unauthenticated attackers to execute arbitrary scripts in the context of a user session.

This vulnerability is a Stored Cross-Site Scripting (XSS) flaw occurring due to insufficient input sanitization and output escaping on the vagaro_code parameter. It allows unauthenticated attackers to inject malicious scripts into web pages, which execute whenever a victim views the affected page.

Successful exploitation of this vulnerability enables attackers to perform unauthorized actions on behalf of users, including administrators, which may lead to account takeover or session hijacking. Given the CVSS score of 7.2, the risk is classified as High due to the lack of required authentication and the potential for persistent impact on the site integrity.

Immediate Action: As no patched version is currently available, users should immediately deactivate and uninstall the Vagaro Booking Widget plugin until a secure update is released by the vendor.

Proactive Monitoring: Review web server logs for suspicious POST requests targeting the plugin settings or pages containing the booking widget.

Compensating Controls: Implement a Web Application Firewall (WAF) with strict XSS filtering rules to block malicious payloads targeting the vagaro_code parameter.

Public Exploit Available: Unknown

Due to the high severity and the ability for unauthenticated actors to execute arbitrary scripts, immediate mitigation is required. Administrators should remove the vulnerable plugin from their WordPress environments until the vendor provides a version that includes proper input sanitization and output escaping.