CVE-2026-121784 · Package
NO FIX YET
The WpBookingly service-booking-manager WordPress plugin by Magepeople does not neutralize input in generated web pages, enabling stored cross-site scripting. An attacker can plant script that runs in the browsers of other users who view the affected page.
first public Nov 7, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the WpBookingly service-booking-manager WordPress plugin at version 1.4.3 or earlier. Stored XSS needs a way for untrusted input to be saved and later rendered, so sites that do not use the plugin can skip it.
Not affected if plugin-not-installed
Who cares self-hosted, wordpress, wpbookingly
wp plugin list with WP-CLI).No fix yet, per the sources.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magepeople inc. WpBookingly service-booking-manager allows Stored XSS.This issue affects WpBookingly: from n/a through 1.4.3.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.