Log in Start free

Jetmonsters

Products

ProductCVEsExploitedLatest
Getwid – Gutenberg Blocks12–Oct 10, 2026
JetFormBuilder — Dynamic Blocks Form Builder9–Nov 3, 2026
JetWidgets For Elementor7–Jul 1, 2026
JetFormBuilder7–Sep 30, 2026
Restaurant Menu by MotoPress6–Aug 18, 2026
Stratum Widgets for Elementor4–Aug 1, 2025
MotoPress Hotel Booking3–Sep 15, 2026
Timetable and Event Schedule by MotoPress3–May 28, 2026
MotoPress Appointment Booking3–Nov 7, 2026
Hotel Booking Lite2–Jul 2, 2026
Mega Menu Block1–May 19, 2025
Getwid1–Sep 22, 2025
Emmet Lite1–Apr 10, 2024
Restaurant Menu and Food Ordering1–Sep 25, 2026
Stratum1–Dec 30, 2025

Exploited and recent CVEs

  • CVE-2026-120741 Medium 5.4 MotoPress Appointment Booking <= 2.4.8 - Unauthenticated Stored Cross-Site Scripting via Customer Name via /customers/create REST Endpoint –
  • CVE-2026-120561 Medium 5.3 JetFormBuilder <= 3.6.2 - Missing Authorization to Unauthenticated JetEngine Options Page Modification 0.3%
  • CVE-2026-103912 Medium 4.7 JetFormBuilder <= 3.6.6 - Reflected DOM-Based Cross-Site Scripting via 'query_var' Dynamic Preset via data-jfb-macro / JFB_FIELD:: Macro Renderer 0.2%
  • CVE-2026-91862 Medium 6.4 Getwid <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-image-points' 0.2%
  • CVE-2026-97342 High 7.2 JetFormBuilder <= 3.6.5.4 - Unauthenticated Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action 0.2%
  • CVE-2026-102391 High 7.1 WordPress JetFormBuilder plugin <= 3.6.5.4 - Cross Site Scripting (XSS) vulnerability 0.1%
  • CVE-2026-96568 High 7.2 Restaurant Menu and Food Ordering <= 2.4.14 - Unauthenticated Stored Cross-Site Scripting via 'phone_number' Parameter 0.2%
  • CVE-2026-92212 Medium 6.1 JetFormBuilder <= 3.6.5.3 - Reflected Cross-Site Scripting via 'jfb_xss' (URL Query Variable) Parameter via Calculated Field 0.3%
  • CVE-2026-5924 Medium 6.4 Getwid <= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Google Maps 'customStyle' 0.3%
  • CVE-2026-12793 Critical 9.8 JetFormBuilder <= 3.6.2 - Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' Parameter 0.5%
  • CVE-2026-90650 High 7.2 MotoPress Hotel Booking <= 6.2.4 - Unauthenticated Stored Cross-Site Scripting via Stripe Webhook Event Object 'id' 0.4%
  • CVE-2026-73400 High 8.1 WordPress Restaurant Menu by MotoPress plugin <= 2.4.11 - Local File Inclusion vulnerability 0.5%
  • CVE-2026-28140 High 7.5 WordPress JetFormBuilder plugin <= 3.6.4.1 - Broken Access Control vulnerability 0.3%
  • CVE-2026-9180 Medium 5.3 MotoPress Appointment Booking <= 2.4.4 - Unauthenticated Insecure Direct Object Reference to 'payment_details.booking_id' Parameter 0.6%
  • CVE-2026-57347 Medium 6.5 WordPress Hotel Booking Lite plugin <= 6.0.3 - Sensitive Data Exposure vulnerability 0.4%
  • CVE-2026-13459 Medium 5.3 JetFormBuilder <= 3.6.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'context' Parameter 0.6%
  • CVE-2026-13454 Medium 6.5 MotoPress Appointment Booking <= 2.4.5 - Authenticated (Staff+) SQL Injection via 's' Parameter 0.5%
  • CVE-2026-11380 Medium 6.4 JetWidgets For Elementor <= 1.0.21 - Authenticated (Author+) Stored Cross-Site Scripting via Animated Box 'animation_effect' Setting 0.3%
  • CVE-2026-57644 High 8.5 WordPress Restaurant Menu by MotoPress plugin <= 2.4.10 - SQL Injection vulnerability 0.4%
  • CVE-2025-63078 Medium 4.3 WordPress Restaurant Menu by MotoPress plugin <= 2.4.11 - Broken Access Control vulnerability 0.3%
  • CVE-2026-54196 Medium 6.8 WordPress JetFormBuilder plugin <= 3.6.1 - Privilege Escalation vulnerability 0.2%
  • CVE-2026-54195 High 7.1 WordPress JetFormBuilder plugin <= 3.6.0.1 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2026-9228 Medium 4.3 Timetable and Event Schedule by MotoPress <= 2.4.16 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via action_get_event_data Function 0.2%
  • CVE-2026-8684 Medium 5.3 MotoPress Hotel Booking <= 6.0.1 - Missing Authorization to Unauthenticated Arbitrary Booking Notes Modification via mphb_update_booking_notes AJAX Action 0.3%
  • CVE-2026-32525 Critical 9.9 WordPress JetFormBuilder plugin <= 3.5.6.1 - Remote Code Execution (RCE) vulnerability 0.3%
  • CVE-2026-4373 High 7.5 JetFormBuilder <= 3.5.6.2 - Unauthenticated Arbitrary File Read via Media Field 0.4%
  • CVE-2025-69013 Medium 4.3 WordPress Stratum plugin <= 1.6.1 - Broken Access Control vulnerability 0.2%
  • CVE-2025-66078 Critical 9.1 WordPress Hotel Booking Lite plugin <= 5.2.3 - Remote Code Execution (RCE) vulnerability 0.4%
  • CVE-2025-49914 Medium 6.5 WordPress Restaurant Menu by MotoPress plugin <= 2.4.7 - Sensitive Data Exposure vulnerability 0.3%
  • CVE-2025-11991 Medium 5.3 JetFormBuilder <= 3.5.3 - Missing Authorization to Unauthenticated Form Generation 0.2%