Jetmonsters vulnerabilities
64 CVEs and advisories name Jetmonsters as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-121977JetFormBuilder <= 3.6.8 - Unauthenticated Stored Cross-Site Scripting via Dynamic Value Block `to_set` Property
- CVE-2026-111317JetFormBuilder <= 3.6.7 - Unauthenticated Stored Cross-Site Scripting via Form Record Preset Source
- CVE-2026-119183JetFormBuilder <= 3.6.8 - Unauthenticated Stored Cross-Site Scripting via '%META::key%' Macro via Post Meta
- CVE-2026-120741MotoPress Appointment Booking <= 2.4.8 - Unauthenticated Stored Cross-Site Scripting via Customer Name via /customers/create REST Endpoint
- CVE-2026-120561JetFormBuilder <= 3.6.2 - Missing Authorization to Unauthenticated JetEngine Options Page Modification
- CVE-2026-103912JetFormBuilder <= 3.6.6 - Reflected DOM-Based Cross-Site Scripting via 'query_var' Dynamic Preset via data-jfb-macro / JFB_FIELD:: Macro Renderer
- CVE-2026-91862Getwid <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-image-points'
- CVE-2026-97342JetFormBuilder <= 3.6.5.4 - Unauthenticated Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action
- CVE-2026-102391WordPress JetFormBuilder plugin <= 3.6.5.4 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-96568Restaurant Menu and Food Ordering <= 2.4.14 - Unauthenticated Stored Cross-Site Scripting via 'phone_number' Parameter
- CVE-2026-92212JetFormBuilder <= 3.6.5.3 - Reflected Cross-Site Scripting via 'jfb_xss' (URL Query Variable) Parameter via Calculated Field
- CVE-2026-5924Getwid <= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Google Maps 'customStyle'
- CVE-2026-12793JetFormBuilder <= 3.6.2 - Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' Parameter
- CVE-2026-90650MotoPress Hotel Booking <= 6.2.4 - Unauthenticated Stored Cross-Site Scripting via Stripe Webhook Event Object 'id'
- CVE-2026-73400WordPress Restaurant Menu by MotoPress plugin <= 2.4.11 - Local File Inclusion vulnerability
- CVE-2026-28140WordPress JetFormBuilder plugin <= 3.6.4.1 - Broken Access Control vulnerability
- CVE-2026-9180MotoPress Appointment Booking <= 2.4.4 - Unauthenticated Insecure Direct Object Reference to 'payment_details.booking_id' Parameter
- CVE-2026-57347WordPress Hotel Booking Lite plugin <= 6.0.3 - Sensitive Data Exposure vulnerability
- CVE-2026-13459JetFormBuilder <= 3.6.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'context' Parameter
- CVE-2026-13454MotoPress Appointment Booking <= 2.4.5 - Authenticated (Staff+) SQL Injection via 's' Parameter
- CVE-2026-11380JetWidgets For Elementor <= 1.0.21 - Authenticated (Author+) Stored Cross-Site Scripting via Animated Box 'animation_effect' Setting
- CVE-2026-57644WordPress Restaurant Menu by MotoPress plugin <= 2.4.10 - SQL Injection vulnerability
- CVE-2025-63078WordPress Restaurant Menu by MotoPress plugin <= 2.4.11 - Broken Access Control vulnerability
- CVE-2026-54196WordPress JetFormBuilder plugin <= 3.6.1 - Privilege Escalation vulnerability
- CVE-2026-54195WordPress JetFormBuilder plugin <= 3.6.0.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-9228Timetable and Event Schedule by MotoPress <= 2.4.16 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via action_get_event_data Function
- CVE-2026-8684MotoPress Hotel Booking <= 6.0.1 - Missing Authorization to Unauthenticated Arbitrary Booking Notes Modification via mphb_update_booking_notes AJAX Action
- CVE-2026-32525WordPress JetFormBuilder plugin <= 3.5.6.1 - Remote Code Execution (RCE) vulnerability
- CVE-2026-4373JetFormBuilder <= 3.5.6.2 - Unauthenticated Arbitrary File Read via Media Field
- CVE-2025-69013WordPress Stratum plugin <= 1.6.1 - Broken Access Control vulnerability