CVE-2026-121784 is a stored cross-site scripting (XSS) vulnerability in the WpBookingly service-booking-manager plugin by Magepeople inc. This vulnerability affects versions up to 1.4.3 and allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts.