CveMateVulnerability intelligence

Jetmonsters vulnerabilities

59 vulnerabilities

Known vulnerabilities in Jetmonsters products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 15 products.

Products

15

Getwid – Gutenberg Blocks12 vulnerabilities
Jetformbuilder — Dynamic Blocks Form Builder8 vulnerabilities
Jetformbuilder7 vulnerabilities
Jetwidgets For Elementor7 vulnerabilities
Restaurant Menu By Motopress6 vulnerabilities
Stratum Widgets For Elementor4 vulnerabilities
Motopress Hotel Booking3 vulnerabilities
Timetable And Event Schedule By Motopress3 vulnerabilities
Hotel Booking Lite2 vulnerabilities
Motopress Appointment Booking2 vulnerabilities
Emmet Lite1 vulnerabilities
Getwid1 vulnerabilities
Mega Menu Block1 vulnerabilities
Restaurant Menu And Food Ordering1 vulnerabilities
Stratum1 vulnerabilities

CVE-2025-63078jetmonstersrestaurant menu by motopress+13mo ago26-06-2026 14:52

Subscriber Broken Access Control in Restaurant Menu by MotoPress <= 2.4.11 versions.CVE-2025-54038jetmonstersrestaurant menu by motopress+11y ago16-07-2025 10:36

Cross-Site Request Forgery (CSRF) vulnerability in jetmonsters Restaurant Menu by MotoPress mp-restaurant-menu allows Cross Site Request Forgery.This issue affects Restaurant Menu by MotoPress: from n/a through <= 2.4.6.CVE-2025-11991jetmonstersjetformbuilder — dynamic blocks form builder+110mo ago16-12-2025 07:21

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the run_callback function in all versions up to, and including, 3.5.3. This makes it possible for unauthenticated attackers to generate forms using AI, consuming site's AI usage limits.CVE-2025-48258jetmonstersmega menu block+11y ago19-05-2025 14:45

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jetmonsters Mega Menu Block getwid-megamenu allows Stored XSS.This issue affects Mega Menu Block: from n/a through <= 1.0.6.CVE-2025-7845jetmonstersstratum widgets for elementor+11y ago01-08-2025 04:24

The Stratum – Elementor Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Advanced Google Maps and Image Hotspot widgets in all versions up to, and including, 1.6.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2025-53990jetmonstersjetformbuilder+11y ago16-07-2025 10:36

Deserialization of Untrusted Data vulnerability in jetmonsters JetFormBuilder jetformbuilder allows Object Injection.This issue affects JetFormBuilder: from n/a through <= 3.5.1.2.CVE-2025-66078jetmonstershotel booking lite+110mo ago18-12-2025 07:22

Improper Control of Generation of Code ('Code Injection') vulnerability in jetmonsters Hotel Booking Lite motopress-hotel-booking-lite allows Remote Code Inclusion.This issue affects Hotel Booking Lite: from n/a through <= 5.2.3.CVE-2025-58252jetmonstersgetwid+11y ago22-09-2025 18:23

Insertion of Sensitive Information Into Sent Data vulnerability in jetmonsters Getwid getwid allows Retrieve Embedded Sensitive Data.This issue affects Getwid: from n/a through <= 2.1.2.CVE-2025-69013jetmonstersstratum+19mo ago30-12-2025 10:47

Missing Authorization vulnerability in jetmonsters Stratum stratum allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Stratum: from n/a through <= 1.6.1.CVE-2025-64384jetmonstersjetformbuilder+111mo ago13-11-2025 09:24

Missing Authorization vulnerability in jetmonsters JetFormBuilder jetformbuilder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetFormBuilder: from n/a through <= 3.5.3.CVE-2025-49914jetmonstersrestaurant menu by motopress+110mo ago18-12-2025 07:21

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in jetmonsters Restaurant Menu by MotoPress mp-restaurant-menu allows Retrieve Embedded Sensitive Data.This issue affects Restaurant Menu by MotoPress: from n/a through <= 2.4.7.CVE-2025-30846jetmonstersrestaurant menu by motopress+11y ago27-03-2025 10:55

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jetmonsters Restaurant Menu by MotoPress mp-restaurant-menu allows PHP Local File Inclusion.This issue affects Restaurant Menu by MotoPress: from n/a through <= 2.4.4.CVE-2025-8195jetmonstersjetwidgets for elementor+110mo ago13-12-2025 08:21

The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Comparison and Subscribe widgets in all versions up to, and including, 1.0.20 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2020-36840jetmonsterstimetable and event schedule by motopress+22y ago16-10-2024 07:31

The Timetable and Event Schedule by MotoPress plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wp_ajax_route_url() function called via a nopriv AJAX action in versions up to, and including, 2.3.8. This makes it possible for unauthenticated attackers to call that function and perform a wide variety of actions such as including random template, injecting malicious web scripts, and more.CVE-2024-2138crocoblockjetwidgets_for_elementor+22y ago09-04-2024 18:59

The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Animated Box widget in all versions up to, and including, 1.0.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2024-2507crocoblockjetwidgets_for_elementor+22y ago09-04-2024 18:59

The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the widget button URL in all versions up to, and including, 1.0.16 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2024-13642jetmonstersstratum widgets for elementor+21y ago30-01-2025 06:41

The Stratum – Elementor Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Hotspot widget in all versions up to, and including, 1.4.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2024-1948jetmonstersgetwid – gutenberg blocks+22y ago09-04-2024 18:58

The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the block content in all versions up to, and including, 2.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2024-31386hidekazu ishikawalightning+292y ago10-04-2024 18:47

Cross-Site Request Forgery (CSRF) vulnerability in Hidekazu Ishikawa X-T9, Hidekazu Ishikawa Lightning, themeinwp Default Mag, Out the Box Namaha, Out the Box CityLogic, Marsian i-max, Jetmonsters Emmet Lite, Macho Themes Decode, Wayneconnor Sliding Door, Out the Box Shopstar!, Modernthemesnet Gridsby, TT Themes HappenStance, Marsian i-excel, Out the Box Panoramic, Modernthemesnet Sensible WP.This issue affects X-T9: from n/a through 1.19.0; Lightning: from n/a through 15.18.0; Default Mag: from n/a through 1.3.5; Namaha: from n/a through 1.0.40; CityLogic: from n/a through 1.1.29; i-max: from n/a through 1.6.2; Emmet Lite: from n/a through 1.7.5; Decode: from n/a through 3.15.3; Sliding Door: from n/a through 3.3; Shopstar!: from n/a through 1.1.33; Gridsby: from n/a through 1.3.0; HappenStance: from n/a through 3.0.1; i-excel: from n/a through 1.7.9; Panoramic: from n/a through 1.1.56; Sensible WP: from n/a through 1.3.1.CVE-2024-4626crocoblockjetwidgets_for_elementor+22y ago20-06-2024 02:08

The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘layout_type’ and 'id' parameters in all versions up to, and including, 1.0.17 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.