# cve.now: Jetmonsters

The newest entries naming Jetmonsters as an affected vendor (up to 200), of 64 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-121977](https://cve.now/CVE-2026-121977.md): JetFormBuilder \<= 3.6.8 - Unauthenticated Stored Cross-Site Scripting via Dynamic Value Block \`to\_set\` Property (CVSS 5.4)
- [CVE-2026-111317](https://cve.now/CVE-2026-111317.md): JetFormBuilder \<= 3.6.7 - Unauthenticated Stored Cross-Site Scripting via Form Record Preset Source (CVSS 7.2)
- [CVE-2026-119183](https://cve.now/CVE-2026-119183.md): JetFormBuilder \<= 3.6.8 - Unauthenticated Stored Cross-Site Scripting via '%META::key%' Macro via Post Meta (CVSS 7.2)
- [CVE-2026-120741](https://cve.now/CVE-2026-120741.md): MotoPress Appointment Booking \<= 2.4.8 - Unauthenticated Stored Cross-Site Scripting via Customer Name via /customers/create REST Endpoint (CVSS 5.4)
- [CVE-2026-120561](https://cve.now/CVE-2026-120561.md): JetFormBuilder \<= 3.6.2 - Missing Authorization to Unauthenticated JetEngine Options Page Modification (CVSS 5.3)
- [CVE-2026-103912](https://cve.now/CVE-2026-103912.md): JetFormBuilder \<= 3.6.6 - Reflected DOM-Based Cross-Site Scripting via 'query\_var' Dynamic Preset via data-jfb-macro / JFB\_FIELD:: Macro Renderer (CVSS 4.7)
- [CVE-2026-91862](https://cve.now/CVE-2026-91862.md): Getwid \<= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-image-points' (CVSS 6.4)
- [CVE-2026-97342](https://cve.now/CVE-2026-97342.md): JetFormBuilder \<= 3.6.5.4 - Unauthenticated Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action (CVSS 7.2)
- [CVE-2026-102391](https://cve.now/CVE-2026-102391.md): WordPress JetFormBuilder plugin \<= 3.6.5.4 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-96568](https://cve.now/CVE-2026-96568.md): Restaurant Menu and Food Ordering \<= 2.4.14 - Unauthenticated Stored Cross-Site Scripting via 'phone\_number' Parameter (CVSS 7.2)
- [CVE-2026-92212](https://cve.now/CVE-2026-92212.md): JetFormBuilder \<= 3.6.5.3 - Reflected Cross-Site Scripting via 'jfb\_xss' (URL Query Variable) Parameter via Calculated Field (CVSS 6.1)
- [CVE-2026-5924](https://cve.now/CVE-2026-5924.md): Getwid \<= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Google Maps 'customStyle' (CVSS 6.4)
- [CVE-2026-12793](https://cve.now/CVE-2026-12793.md): JetFormBuilder \<= 3.6.2 - Unauthenticated Privilege Escalation via '\_jet\_engine\_booking\_form\_id' Parameter (CVSS 9.8)
- [CVE-2026-90650](https://cve.now/CVE-2026-90650.md): MotoPress Hotel Booking \<= 6.2.4 - Unauthenticated Stored Cross-Site Scripting via Stripe Webhook Event Object 'id' (CVSS 7.2)
- [CVE-2026-73400](https://cve.now/CVE-2026-73400.md): WordPress Restaurant Menu by MotoPress plugin \<= 2.4.11 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2026-28140](https://cve.now/CVE-2026-28140.md): WordPress JetFormBuilder plugin \<= 3.6.4.1 - Broken Access Control vulnerability (CVSS 7.5)
- [CVE-2026-9180](https://cve.now/CVE-2026-9180.md): MotoPress Appointment Booking \<= 2.4.4 - Unauthenticated Insecure Direct Object Reference to 'payment\_details.booking\_id' Parameter (CVSS 5.3)
- [CVE-2026-57347](https://cve.now/CVE-2026-57347.md): WordPress Hotel Booking Lite plugin \<= 6.0.3 - Sensitive Data Exposure vulnerability (CVSS 6.5)
- [CVE-2026-13459](https://cve.now/CVE-2026-13459.md): JetFormBuilder \<= 3.6.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'context' Parameter (CVSS 5.3)
- [CVE-2026-13454](https://cve.now/CVE-2026-13454.md): MotoPress Appointment Booking \<= 2.4.5 - Authenticated (Staff+) SQL Injection via 's' Parameter (CVSS 6.5)
- [CVE-2026-11380](https://cve.now/CVE-2026-11380.md): JetWidgets For Elementor \<= 1.0.21 - Authenticated (Author+) Stored Cross-Site Scripting via Animated Box 'animation\_effect' Setting (CVSS 6.4)
- [CVE-2026-57644](https://cve.now/CVE-2026-57644.md): WordPress Restaurant Menu by MotoPress plugin \<= 2.4.10 - SQL Injection vulnerability (CVSS 8.5)
- [CVE-2025-63078](https://cve.now/CVE-2025-63078.md): WordPress Restaurant Menu by MotoPress plugin \<= 2.4.11 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2026-54196](https://cve.now/CVE-2026-54196.md): WordPress JetFormBuilder plugin \<= 3.6.1 - Privilege Escalation vulnerability (CVSS 6.8)
- [CVE-2026-54195](https://cve.now/CVE-2026-54195.md): WordPress JetFormBuilder plugin \<= 3.6.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-9228](https://cve.now/CVE-2026-9228.md): Timetable and Event Schedule by MotoPress \<= 2.4.16 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via action\_get\_event\_data Function (CVSS 4.3)
- [CVE-2026-8684](https://cve.now/CVE-2026-8684.md): MotoPress Hotel Booking \<= 6.0.1 - Missing Authorization to Unauthenticated Arbitrary Booking Notes Modification via mphb\_update\_booking\_notes AJAX Action (CVSS 5.3)
- [CVE-2026-32525](https://cve.now/CVE-2026-32525.md): WordPress JetFormBuilder plugin \<= 3.5.6.1 - Remote Code Execution (RCE) vulnerability (CVSS 9.9)
- [CVE-2026-4373](https://cve.now/CVE-2026-4373.md): JetFormBuilder \<= 3.5.6.2 - Unauthenticated Arbitrary File Read via Media Field (CVSS 7.5)
- [CVE-2025-69013](https://cve.now/CVE-2025-69013.md): WordPress Stratum plugin \<= 1.6.1 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2025-66078](https://cve.now/CVE-2025-66078.md): WordPress Hotel Booking Lite plugin \<= 5.2.3 - Remote Code Execution (RCE) vulnerability (CVSS 9.1)
- [CVE-2025-49914](https://cve.now/CVE-2025-49914.md): WordPress Restaurant Menu by MotoPress plugin \<= 2.4.7 - Sensitive Data Exposure vulnerability (CVSS 6.5)
- [CVE-2025-11991](https://cve.now/CVE-2025-11991.md): JetFormBuilder \<= 3.5.3 - Missing Authorization to Unauthenticated Form Generation (CVSS 5.3)
- [CVE-2025-8195](https://cve.now/CVE-2025-8195.md): JetWidgets For Elementor \<= 1.0.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Comparison and Subscribe Widgets (CVSS 6.4)
- [CVE-2025-64384](https://cve.now/CVE-2025-64384.md): WordPress JetFormBuilder plugin \<= 3.5.3 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2025-58252](https://cve.now/CVE-2025-58252.md): WordPress Getwid Plugin \<= 2.1.2 - Sensitive Data Exposure Vulnerability (CVSS 4.3)
- [CVE-2025-7845](https://cve.now/CVE-2025-7845.md): Stratum – Elementor Widgets \<= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Google Maps and Image Hotspot Widgets (CVSS 6.4)
- [CVE-2025-54038](https://cve.now/CVE-2025-54038.md): WordPress Restaurant Menu by MotoPress plugin \<= 2.4.6 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 5.4)
- [CVE-2025-53990](https://cve.now/CVE-2025-53990.md): WordPress JetFormBuilder plugin \<= 3.5.1.2 - PHP Object Injection Vulnerability (CVSS 7.2)
- [CVE-2025-48258](https://cve.now/CVE-2025-48258.md): WordPress Mega Menu Block plugin \<= 1.0.6 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5)
- [CVE-2025-30846](https://cve.now/CVE-2025-30846.md): WordPress Restaurant Menu by MotoPress plugin \<= 2.4.4 - Local File Inclusion vulnerability (CVSS 8.8)
- [CVE-2024-13642](https://cve.now/CVE-2024-13642.md): Stratum – Elementor Widgets \<= 1.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting Vulnerability via Image Hotspot Widget (CVSS 6.4)
- [CVE-2024-5020](https://cve.now/CVE-2024-5020.md): Multiple Plugins \<= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library (CVSS 6.4)
- [CVE-2024-10316](https://cve.now/CVE-2024-10316.md): Stratum – Elementor Widgets \<= 1.4.4 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates (CVSS 4.3)
- [CVE-2024-10872](https://cve.now/CVE-2024-10872.md): Getwid – Gutenberg Blocks \<= 2.0.12 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-10323](https://cve.now/CVE-2024-10323.md): JetWidgets For Elementor \<= 1.0.18 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4)
- [CVE-2020-36840](https://cve.now/CVE-2020-36840.md): Timetable and Event Schedule by MotoPress \<= 2.3.8 - Missing Authorization (CVSS 7.3)
- [CVE-2024-7291](https://cve.now/CVE-2024-7291.md): JetFormBuilder \<= 3.3.4.1 - Authenticated (Administrator+) Privilege Escalation (CVSS 7.2)
- [CVE-2024-6489](https://cve.now/CVE-2024-6489.md): Getwid – Gutenberg Blocks \<= 2.0.10 - Missing Authorization to Google API key update (CVSS 5.3)
- [CVE-2024-6491](https://cve.now/CVE-2024-6491.md): Getwid – Gutenberg Blocks \<= 2.0.10 - Missing Authentication to MailChimp API key update (CVSS 4.3)
- [CVE-2024-4626](https://cve.now/CVE-2024-4626.md): JetWidgets For Elementor \<= 1.0.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via layout\_type and id Parameters (CVSS 6.4)
- [CVE-2024-5611](https://cve.now/CVE-2024-5611.md): Stratum – Elementor Widgets \<= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget (CVSS 6.4)
- [CVE-2024-4413](https://cve.now/CVE-2024-4413.md): Hotel Booking Lite \<= 4.11.1 - Unauthenticated PHP Object Injection (CVSS 9.8)
- [CVE-2024-3588](https://cve.now/CVE-2024-3588.md): Getwid – Gutenberg Blocks \<= 2.0.7 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'Countdown' (CVSS 6.4)
- [CVE-2024-3342](https://cve.now/CVE-2024-3342.md): Timetable and Event Schedule by MotoPress \<= 2.4.11 - Authenticated (Contributor+) SQL Injection (CVSS 9.9)
- [CVE-2024-31386](https://cve.now/CVE-2024-31386.md): Multiple WordPress themes affected by Cross-Site Request Forgery vulnerability (CVSS 4.3)
- [CVE-2024-2138](https://cve.now/CVE-2024-2138.md): JetWidgets For Elementor \<= 1.0.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animated Box Widget (CVSS 6.4)
- [CVE-2024-2507](https://cve.now/CVE-2024-2507.md): JetWidgets For Elementor \<= 1.0.16 - Authenticated(Contributor+) Stored Cross-Site Scripting via Widget Button URL (CVSS 6.4)
- [CVE-2024-1948](https://cve.now/CVE-2024-1948.md): Getwid – Gutenberg Blocks \<= 2.0.5 - Authenticated(Contributor+) Stored Cross-Site Scripting via Block Content (CVSS 6.4)
- [CVE-2023-6963](https://cve.now/CVE-2023-6963.md): Getwid – Gutenberg Blocks \<= 2.0.4 - Captcha Bypass (CVSS 5.3)
- [CVE-2023-6959](https://cve.now/CVE-2023-6959.md): Getwid – Gutenberg Blocks \<= 2.0.4 - Missing Authorization to Recaptcha API Key Modification (CVSS 4.3)
- [CVE-2023-1895](https://cve.now/CVE-2023-1895.md): Getwid – Gutenberg Blocks \<= 1.8.3 - Authenticated(Subscriber+) Server Side Request Forgery (CVSS 8.5)
- [CVE-2023-1910](https://cve.now/CVE-2023-1910.md): Getwid – Gutenberg Blocks \<= 1.8.3 - Improper Authorization via get\_remote\_templates REST endpoint (CVSS 4.3)
- [CVE-2023-0086](https://cve.now/CVE-2023-0086.md): JetWidgets for Elementor \<= 1.0.12 - Cross-Site Request Forgery to Settings Update (CVSS 5.4)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/jetmonsters
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.