Jetmonsters vulnerabilities, page 2

59 vulnerabilities

Known vulnerabilities in Jetmonsters products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 15 products.

9.8CriticalCVE-2024-4413jetmonsters · motopress hotel booking +1 moreHotel Booking Lite <= 4.11.1 - Unauthenticated PHP Object InjectionThe Hotel Booking Lite plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.11.1 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.EPSS0.85%7.2HighCVE-2024-7291jetmonsters · jetformbuilder — dynamic blocks form builder +1 moreJetFormBuilder <= 3.3.4.1 - Authenticated (Administrator+) Privilege EscalationThe JetFormBuilder plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.3.4.1. This is due to improper restriction on user meta fields. This makes it possible for authenticated attackers, with administrator-level and above permissions, to register as super-admins on the sites configured as multi-sites.EPSS0.53%6.4MediumCVE-2024-5611jetmonsters · stratum widgets for elementor +1 moreStratum – Elementor Widgets <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown WidgetThe Stratum – Elementor Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘label_years’ attribute within the Countdown widget in all versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.EPSS0.33%6.4MediumCVE-2024-502010web · form maker by 10web – mobile-friendly drag & drop contact form builder +30 moreMultiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript LibraryMultiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled FancyBox JavaScript library (versions 1.3.4 to 3.5.7) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.EPSS0.43%6.4MediumCVE-2024-10872jetmonsters · getwid – gutenberg blocks +2 moreGetwid – Gutenberg Blocks <= 2.0.12 - Authenticated (Contributor+) Stored Cross-Site ScriptingThe Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `template-post-custom-field` block in all versions up to, and including, 2.0.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.EPSS0.31%6.4MediumCVE-2024-10323crocoblock · jetwidgets_for_elementor +2 moreJetWidgets For Elementor <= 1.0.18 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadThe JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, and including, 1.0.18 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.EPSS0.32%4.3MediumCVE-2024-10316jetmonsters · stratum widgets for elementor +1 moreStratum – Elementor Widgets <= 1.4.4 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor TemplatesThe Stratum – Elementor Widgets plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.4 in includes/templates/content-switcher.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft template data.EPSS0.52%5.3MediumCVE-2024-6489jetmonsters · getwid – gutenberg blocks +2 moreGetwid – Gutenberg Blocks <= 2.0.10 - Missing Authorization to Google API key updateThe Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the get_google_api_key function in all versions up to, and including, 2.0.10. This makes it possible for authenticated attackers, with Contributor-level access and above, to set the MailChimp API key.EPSS0.30%4.3MediumCVE-2024-6491jetmonsters · getwid – gutenberg blocks +2 moreGetwid – Gutenberg Blocks <= 2.0.10 - Missing Authentication to MailChimp API key updateThe Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the mailchimp_api_key_manage function in all versions up to, and including, 2.0.10. This makes it possible for authenticated attackers, with Contributor-level access and above, to set the MailChimp API key.EPSS0.38%9.9CriticalCVE-2024-3342jetmonsters · timetable and event schedule by motopress +1 moreTimetable and Event Schedule by MotoPress <= 2.4.11 - Authenticated (Contributor+) SQL InjectionThe Timetable and Event Schedule by MotoPress plugin for WordPress is vulnerable to SQL Injection via the 'events' attribute of the 'mp-timetable' shortcode in all versions up to, and including, 2.4.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.EPSS0.56%6.4MediumCVE-2024-3588jetmonsters · getwid – gutenberg blocks +2 moreGetwid – Gutenberg Blocks <= 2.0.7 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'Countdown'The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown block in all versions up to, and including, 2.0.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.EPSS0.53%8.8HighCVE-2026-54196jetmonsters · jetformbuilder +1 moreWordPress JetFormBuilder plugin <= 3.6.1 - Privilege Escalation vulnerabilityIncorrect Privilege Assignment vulnerability in Jetmonsters JetFormBuilder allows Privilege Escalation. This issue affects JetFormBuilder: from n/a through 3.6.1.EPSS0.28%7.2HighCVE-2026-54195jetmonsters · jetformbuilder +1 moreWordPress JetFormBuilder plugin <= 3.6.0.1 - Cross Site Scripting (XSS) vulnerabilityUnauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.0.1 versions.EPSS0.25%8.1HighCVE-2026-73400jetmonsters · restaurant menu by motopress +1 moreWordPress Restaurant Menu by MotoPress plugin <= 2.4.11 - Local File Inclusion vulnerabilityUnauthenticated Local File Inclusion in Restaurant Menu by MotoPress <= 2.4.11 versions.EPSS0.47%6.4MediumCVE-2026-91862jetmonsters · getwid – gutenberg blocks +1 moreGetwid <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-image-points'The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data-image-points' parameter in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.EPSS0.16%5.3MediumCVE-2026-13459jetmonsters · jetformbuilder — dynamic blocks form builder +1 moreJetFormBuilder <= 3.6.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'context' ParameterThe JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve every distinct value stored under any arbitrary wp_postmeta key on the site — including WooCommerce billing PII such as _billing_email, _billing_phone, and _billing_address fields, order totals, attachment paths, and any third-party plugin credentials or tokens stored in post meta — provided at least one published JetFormBuilder form with a get_from_db generator field exists on the site. Exploitation requires that the target site has at least one published jet-form-builder post containing a field whose generator_function is set to get_from_db; an attacker must supply a matching form ID, field name, and generator ID in the request, but all of these can be discovered by browsing the site's public forms.EPSS0.58%6.5MediumCVE-2026-13454jetmonsters · motopress appointment booking +1 moreMotoPress Appointment Booking <= 2.4.5 - Authenticated (Staff+) SQL Injection via 's' ParameterThe MotoPress Appointment Booking plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all versions up to, and including, 2.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires the mpa_appointment_employee custom role, meaning any user assigned this role can perform the attack.EPSS0.45%6.4MediumCVE-2026-11380jetmonsters · jetwidgets for elementor +1 moreJetWidgets For Elementor <= 1.0.21 - Authenticated (Author+) Stored Cross-Site Scripting via Animated Box 'animation_effect' SettingThe JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 1.0.21. This is due to insufficient output escaping and missing server-side validation of the Animated Box widget's animation_effect setting before it is rendered inside an HTML class attribute. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.EPSS0.26%7.2HighCVE-2026-102391jetmonsters · jetformbuilder +1 moreWordPress JetFormBuilder plugin <= 3.6.5.4 - Cross Site Scripting (XSS) vulnerabilityUnauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.5.4 versions.EPSS0.15%4.3MediumCVE-2026-9228jetmonsters · timetable and event schedule by motopress +1 moreTimetable and Event Schedule by MotoPress <= 2.4.16 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via action_get_event_data FunctionThe Timetable and Event Schedule by MotoPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.4.16 via the action_get_event_data due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access and above, to enumerate timeslot IDs and read the full WP_Post object — including post_content, post_excerpt, post_status, and post_author — of draft, pending, and private mp-event posts belonging to other users, along with their associated raw timeslot descriptions.EPSS0.38%