Jetmonsters vulnerabilities

Products

• Jetformbuilder 19
• Jetformbuilder — Dynamic Blocks Form Builder 16
• Getwid – Gutenberg Blocks 12
• Jetwidgets For Elementor 9
• Restaurant Menu By Motopress 7
• Motopress Hotel Booking 6
• Hotel Booking Lite 4
• Motopress Appointment Booking 4
• Stratum Widgets For Elementor 4
• Timetable And Event Schedule By Motopress 3
• Getwid 2
• Stratum 2

Newest

• crocoblock jetformbuilder WordPress JetFormBuilder plugin <= 3.6.8 - Content Injection vulnerability CVE-2026-123860 5.3 MediumNovember 7, 2026
• crocoblock jetformbuilder WordPress JetFormBuilder plugin <= 3.6.8 - Content Injection vulnerability CVE-2026-123483 5.3 MediumNovember 7, 2026
• jetmonsters jetformbuilder — dynamic blocks form builder JetFormBuilder <= 3.6.8 - Unauthenticated Stored Cross-Site Scripting via Dynamic Value Block `to_set` Property CVE-2026-121977 5.4 MediumNovember 7, 2026
• jetmonsters jetformbuilder — dynamic blocks form builder JetFormBuilder <= 3.6.7 - Unauthenticated Stored Cross-Site Scripting via Form Record Preset Source CVE-2026-111317 7.2 HighNovember 7, 2026
• jetmonsters jetformbuilder — dynamic blocks form builder JetFormBuilder <= 3.6.8 - Unauthenticated Stored Cross-Site Scripting via '%META::key%' Macro via Post Meta CVE-2026-119183 7.2 HighNovember 7, 2026
• jetmonsters motopress appointment booking MotoPress Appointment Booking <= 2.4.8 - Unauthenticated Stored Cross-Site Scripting via Customer Name via /customers/create REST Endpoint CVE-2026-120741 5.4 MediumNovember 7, 2026
• crocoblock jetformbuilder WordPress JetFormBuilder plugin <= 3.6.7.1 - Privilege Escalation vulnerability CVE-2026-119481 9.8 CriticalNovember 4, 2026
• jetmonsters jetformbuilder — dynamic blocks form builder JetFormBuilder <= 3.6.2 - Missing Authorization to Unauthenticated JetEngine Options Page Modification CVE-2026-120561 5.3 MediumNovember 3, 2026
• crocoblock jetformbuilder WordPress JetFormBuilder plugin <= 3.6.7.1 - Attachment Deletion Via Media-Field Preset vulnerability CVE-2026-119480 6.5 MediumNovember 1, 2026
• crocoblock jetformbuilder WordPress JetFormBuilder plugin <= 3.6.7.1 - Content Injection vulnerability CVE-2026-119479 5.3 MediumOctober 30, 2026
• crocoblock jetformbuilder WordPress JetFormBuilder plugin <= 3.6.7.1 - Broken Access Control vulnerability CVE-2026-119482 5.3 MediumOctober 30, 2026
• crocoblock jetformbuilder WordPress JetFormBuilder plugin <= 3.6.6 - Broken Access Control vulnerability CVE-2026-107431 7.5 HighOctober 14, 2026
• jetmonsters jetformbuilder — dynamic blocks form builder JetFormBuilder <= 3.6.6 - Reflected DOM-Based Cross-Site Scripting via 'query_var' Dynamic Preset via data-jfb-macro / JFB_FIELD:: Macro Renderer CVE-2026-103912 4.7 MediumOctober 10, 2026
• jetmonsters getwid – gutenberg blocks Getwid <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-image-points' CVE-2026-91862 6.4 MediumOctober 10, 2026
• jetmonsters jetformbuilder — dynamic blocks form builder JetFormBuilder <= 3.6.5.4 - Unauthenticated Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action CVE-2026-97342 7.2 HighOctober 2, 2026
• jetmonsters jetformbuilder WordPress JetFormBuilder plugin <= 3.6.5.4 - Cross Site Scripting (XSS) vulnerability CVE-2026-102391 7.1 HighSeptember 30, 2026
• jetmonsters restaurant menu and food ordering Restaurant Menu and Food Ordering <= 2.4.14 - Unauthenticated Stored Cross-Site Scripting via 'phone_number' Parameter CVE-2026-96568 7.2 HighSeptember 25, 2026
• jetmonsters jetformbuilder — dynamic blocks form builder JetFormBuilder <= 3.6.5.3 - Reflected Cross-Site Scripting via 'jfb_xss' (URL Query Variable) Parameter via Calculated Field CVE-2026-92212 6.1 MediumSeptember 25, 2026
• jetmonsters getwid – gutenberg blocks Getwid <= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Google Maps 'customStyle' CVE-2026-5924 6.4 MediumSeptember 23, 2026
• jetmonsters jetformbuilder — dynamic blocks form builder JetFormBuilder 3.5.6.2 - 3.6.5.2 - Admin+ Arbitrary File Deletion via Server-Side Validation Callback CVE-2026-19860 5.5 MediumSeptember 19, 2026
• jetmonsters jetformbuilder — dynamic blocks form builder JetFormBuilder <= 3.6.2 - Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' Parameter CVE-2026-12793 Public exploit 9.8 CriticalSeptember 16, 2026
• jetmonsters motopress hotel booking MotoPress Hotel Booking <= 6.2.4 - Unauthenticated Stored Cross-Site Scripting via Stripe Webhook Event Object 'id' CVE-2026-90650 7.2 HighSeptember 15, 2026
• crocoblock jetformbuilder WordPress JetFormBuilder plugin <= 3.6.5.1 - Cross Site Scripting (XSS) vulnerability CVE-2026-84817 7.1 HighSeptember 8, 2026
• jetmonsters jetformbuilder JetFormBuilder < 3.6.5.2 - Unauthenticated Email Header Injection via Send Email Action CVE-2026-19862 4.8 MediumSeptember 6, 2026
• jetmonsters jetformbuilder JetFormBuilder < 3.6.5.2 - Unauthenticated Arbitrary Shortcode Execution via 'status' Parameter CVE-2026-19859 6.5 MediumSeptember 6, 2026
• jetmonsters jetformbuilder — dynamic blocks form builder JetFormBuilder < 3.6.5.2 - Unauthenticated Stored XSS via WYSIWYG Field in Notification Emails CVE-2026-19861 4.7 MediumSeptember 5, 2026
• jetmonsters jetformbuilder — dynamic blocks form builder JetFormBuilder < 3.6.5.2 - Unauthenticated Password Hash and Arbitrary Metadata Disclosure via Dynamic Preset CVE-2026-19858 7.5 HighSeptember 5, 2026
• jetmonsters motopress appointment booking Appointment Booking Lite < 2.4.8 - Unauthenticated Arbitrary Reservation Deletion CVE-2026-15232 5.3 MediumSeptember 2, 2026
• jetmonsters restaurant menu by motopress WordPress Restaurant Menu by MotoPress plugin <= 2.4.11 - Local File Inclusion vulnerability CVE-2026-73400 8.1 HighAugust 18, 2026
• jetmonsters motopress hotel booking Hotel Booking Lite < 6.2.3 - Subscriber+ Customer Data Modification via IDOR CVE-2026-15238 5.4 MediumAugust 10, 2026
• jetmonsters motopress hotel booking Hotel Booking Lite < 6.2.3 - Unauthenticated Payment Record Creation via Checkout Payments REST Endpoint CVE-2026-15237 5.3 MediumAugust 10, 2026
• jetmonsters jetformbuilder WordPress JetFormBuilder plugin <= 3.6.4.1 - Broken Access Control vulnerability CVE-2026-28140 7.5 HighAugust 6, 2026
• jetmonsters motopress hotel booking Hotel Booking Lite < 6.0.4 - Subscriber+ Sensitive Data Disclosure via Admin Calendar AJAX Action CVE-2026-15235 4.3 MediumJuly 30, 2026
• jetmonsters motopress appointment booking MotoPress Appointment Booking <= 2.4.4 - Unauthenticated Insecure Direct Object Reference to 'payment_details.booking_id' Parameter CVE-2026-9180 5.3 MediumJuly 3, 2026
• jetmonsters hotel booking lite WordPress Hotel Booking Lite plugin <= 6.0.3 - Sensitive Data Exposure vulnerability CVE-2026-57347 6.5 MediumJuly 2, 2026
• jetmonsters jetformbuilder — dynamic blocks form builder JetFormBuilder <= 3.6.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'context' Parameter CVE-2026-13459 5.3 MediumJuly 2, 2026
• jetmonsters motopress appointment booking MotoPress Appointment Booking <= 2.4.5 - Authenticated (Staff+) SQL Injection via 's' Parameter CVE-2026-13454 6.5 MediumJuly 1, 2026
• jetmonsters jetwidgets for elementor JetWidgets For Elementor <= 1.0.21 - Authenticated (Author+) Stored Cross-Site Scripting via Animated Box 'animation_effect' Setting CVE-2026-11380 6.4 MediumJuly 1, 2026
• jetmonsters restaurant menu by motopress WordPress Restaurant Menu by MotoPress plugin <= 2.4.10 - SQL Injection vulnerability CVE-2026-57644 8.5 HighJune 26, 2026
• jetmonsters restaurant menu by motopress WordPress Restaurant Menu by MotoPress plugin <= 2.4.11 - Broken Access Control vulnerability CVE-2025-63078 4.3 MediumJune 26, 2026
• jetmonsters jetformbuilder WordPress JetFormBuilder plugin <= 3.6.1 - Privilege Escalation vulnerability CVE-2026-54196 6.8 MediumJune 17, 2026
• jetmonsters jetformbuilder WordPress JetFormBuilder plugin <= 3.6.0.1 - Cross Site Scripting (XSS) vulnerability CVE-2026-54195 7.1 HighJune 17, 2026
• jetmonsters timetable and event schedule by motopress Timetable and Event Schedule by MotoPress <= 2.4.16 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via action_get_event_data Function CVE-2026-9228 4.3 MediumMay 28, 2026
• jetmonsters motopress hotel booking MotoPress Hotel Booking <= 6.0.1 - Missing Authorization to Unauthenticated Arbitrary Booking Notes Modification via mphb_update_booking_notes AJAX Action CVE-2026-8684 5.3 MediumMay 22, 2026
• jetmonsters jetformbuilder WordPress JetFormBuilder plugin <= 3.5.6.1 - Remote Code Execution (RCE) vulnerability CVE-2026-32525 9.9 CriticalMarch 25, 2026
• jetmonsters jetformbuilder — dynamic blocks form builder JetFormBuilder <= 3.5.6.2 - Unauthenticated Arbitrary File Read via Media Field CVE-2026-4373 7.5 HighMarch 21, 2026
• jetmonsters stratum WordPress Stratum plugin <= 1.6.1 - Broken Access Control vulnerability CVE-2025-69013 4.3 MediumDecember 30, 2025
• jetmonsters hotel booking lite WordPress Hotel Booking Lite plugin <= 5.2.3 - Remote Code Execution (RCE) vulnerability CVE-2025-66078 9.1 CriticalDecember 18, 2025
• jetmonsters restaurant menu by motopress WordPress Restaurant Menu by MotoPress plugin <= 2.4.7 - Sensitive Data Exposure vulnerability CVE-2025-49914 6.5 MediumDecember 18, 2025
• jetmonsters jetformbuilder — dynamic blocks form builder JetFormBuilder <= 3.5.3 - Missing Authorization to Unauthenticated Form Generation CVE-2025-11991 5.3 MediumDecember 16, 2025
• Show olderLoading…