Jetmonsters
41 CVEs across 14 Jetmonsters products. Browse Jetmonsters vulnerabilities, severities, and proof-of-concept exploits.
Jetmonsters products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-28140 | High | 7.5 | 2026-08-06 | Unauthenticated Broken Access Control in JetFormBuilder <= 3.6.4.1 versions. |
CVE-2026-9180 | Medium | 5.3 | 2026-07-03 | The MotoPress Appointment Booking plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to, and including… |
CVE-2026-57347 | Medium | 6.5 | 2026-07-02 | Subscriber Sensitive Data Exposure in Hotel Booking Lite <= 6.0.3 versions. |
CVE-2026-13459 | Medium | 5.3 | 2026-07-02 | The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.3. This i… |
CVE-2026-13454 | Medium | 6.5 | 2026-07-01 | The MotoPress Appointment Booking plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all versions up to, and including, 2.4.5… |
CVE-2026-11380 | Medium | 6.4 | 2026-07-01 | The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 1.0.21. This is due to insuffici… |
CVE-2026-57644 | High | 8.5 | 2026-06-26 | Contributor SQL Injection in Restaurant Menu by MotoPress <= 2.4.10 versions. |
CVE-2025-63078 | Medium | 4.3 | 2026-06-26 | Subscriber Broken Access Control in Restaurant Menu by MotoPress <= 2.4.11 versions. |
CVE-2026-54196 | Medium | 6.8 | 2026-06-17 | Subscriber Privilege Escalation in JetFormBuilder <= 3.6.1 versions. |
CVE-2026-54195 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.0.1 versions. |
CVE-2026-9228 | Medium | 4.3 | 2026-05-28 | The Timetable and Event Schedule by MotoPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.4… |
CVE-2026-8684 | Medium | 5.3 | 2026-05-22 | The MotoPress Hotel Booking plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.0.1. This is due to the plugin n… |
CVE-2026-32525 | Critical | 9.9 | 2026-03-25 | Improper Control of Generation of Code ('Code Injection') vulnerability in jetmonsters JetFormBuilder jetformbuilder allows Code Injection.This issue affects J… |
CVE-2026-4373 | High | 7.5 | 2026-03-21 | The JetFormBuilder plugin for WordPress is vulnerable to arbitrary file read via path traversal in all versions up to, and including, 3.5.6.2. This is due to t… |
CVE-2025-69013 | Medium | 4.3 | 2025-12-30 | Missing Authorization vulnerability in jetmonsters Stratum stratum allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects S… |
CVE-2025-66078 | Critical | 9.1 | 2025-12-18 | Improper Control of Generation of Code ('Code Injection') vulnerability in jetmonsters Hotel Booking Lite motopress-hotel-booking-lite allows Remote Code Inclu… |
CVE-2025-49914 | Medium | 6.5 | 2025-12-18 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in jetmonsters Restaurant Menu by MotoPress mp-restaurant-menu allows… |
CVE-2025-11991 | Medium | 5.3 | 2025-12-16 | The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on t… |
CVE-2025-8195 | Medium | 6.4 | 2025-12-13 | The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Comparison and Subscribe widgets in all v… |
CVE-2025-64384 | Medium | 5.3 | 2025-11-13 | Missing Authorization vulnerability in jetmonsters JetFormBuilder jetformbuilder allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2025-58252 | Medium | 4.3 | 2025-09-22 | Insertion of Sensitive Information Into Sent Data vulnerability in jetmonsters Getwid getwid allows Retrieve Embedded Sensitive Data.This issue affects Getwid… |
CVE-2025-7845 | Medium | 6.4 | 2025-08-01 | The Stratum – Elementor Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Advanced Google Maps and Image Hotspot widge… |
CVE-2025-54038 | Medium | 5.4 | 2025-07-16 | Cross-Site Request Forgery (CSRF) vulnerability in jetmonsters Restaurant Menu by MotoPress mp-restaurant-menu allows Cross Site Request Forgery.This issue aff… |
CVE-2025-53990 | High | 7.2 | 2025-07-16 | Deserialization of Untrusted Data vulnerability in jetmonsters JetFormBuilder jetformbuilder allows Object Injection.This issue affects JetFormBuilder: from n/… |
CVE-2025-48258 | Medium | 6.5 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jetmonsters Mega Menu Block getwid-megamenu allows Stored… |
CVE-2025-30846 | High | 8.8 | 2025-03-27 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jetmonsters Restaurant Menu by MotoPre… |
CVE-2024-13642 | Medium | 6.4 | 2025-01-30 | The Stratum – Elementor Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Hotspot widget in all versions up to… |
CVE-2024-5020 | Medium | 6.4 | 2024-12-04 | Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled FancyBox JavaScript library (versions 1.3.4 to 3.5.7) in… |
CVE-2024-10316 | Medium | 4.3 | 2024-11-21 | The Stratum – Elementor Widgets plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.4 in includes/te… |
CVE-2024-10872 | Medium | 6.4 | 2024-11-20 | The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `template-post-custom-field` block in all versions up t… |
CVE-2024-10323 | Medium | 6.4 | 2024-11-12 | The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, and includi… |
CVE-2020-36840 | High | 7.3 | 2024-10-16 | The Timetable and Event Schedule by MotoPress plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wp_ajax_route… |
CVE-2024-7291 | High | 7.2 | 2024-08-03 | The JetFormBuilder plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.3.4.1. This is due to improper restrictio… |
CVE-2024-6491 | Medium | 4.3 | 2024-07-20 | The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the mailchimp_api_ke… |
CVE-2024-6489 | Medium | 5.3 | 2024-07-20 | The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the get_google_api_k… |
CVE-2024-4626 | Medium | 6.4 | 2024-06-20 | The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘layout_type’ and 'id' parameters in all versions up to… |
CVE-2024-5611 | Medium | 6.4 | 2024-06-15 | The Stratum – Elementor Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘label_years’ attribute within the Countdown widget i… |
CVE-2024-4413 | Critical | 9.8 | 2024-05-14 | The Hotel Booking Lite plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.11.1 via deserialization of untrusted… |
CVE-2024-3588 | Medium | 6.4 | 2024-05-02 | The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown block in all versions up to, and inc… |
CVE-2024-3342 | Critical | 9.9 | 2024-04-27 | The Timetable and Event Schedule by MotoPress plugin for WordPress is vulnerable to SQL Injection via the 'events' attribute of the 'mp-timetable' shortcode in… |
CVE-2024-31386 | Medium | 4.3 | 2024-04-10 | Cross-Site Request Forgery (CSRF) vulnerability in Hidekazu Ishikawa X-T9, Hidekazu Ishikawa Lightning, themeinwp Default Mag, Out the Box Namaha, Out the Box… |
CVE-2024-2507 | Medium | 6.4 | 2024-04-09 | The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the widget button URL in all versions up to, and including… |
CVE-2024-2138 | Medium | 6.4 | 2024-04-09 | The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Animated Box widget in all versions up to, and including… |
CVE-2024-1948 | Medium | 6.4 | 2024-04-09 | The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the block content in all versions up to, and including, 2.0… |
CVE-2023-6963 | Medium | 5.3 | 2024-02-05 | The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to CAPTCHA Bypass in versions up to, and including, 2.0.4. This makes it possible for unauthen… |
CVE-2023-6959 | Medium | 4.3 | 2024-02-05 | The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the recaptcha_api_ke… |
CVE-2023-1910 | Medium | 4.3 | 2023-06-09 | The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to unauthorized modification of data due to an insufficient capability check on the get_remote… |
CVE-2023-1895 | High | 8.5 | 2023-06-09 | The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Server Side Request Forgery via the get_remote_content REST API endpoint in versions up to… |
CVE-2023-0086 | Medium | 5.4 | 2023-01-05 | The JetWidgets for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.12. This is due to missing… |