Jetmonsters vulnerabilities
We track 15 vulnerabilities in Jetmonsters products across 8 products. 15 are rated high or critical, and none are known to be exploited. The most recent was published on November 7, 2026.
Latest Jetmonsters vulnerabilities
- 7.2 High severity
JetFormBuilder — Dynamic Blocks Form Builder: Improper Neutralization of Input During Web Page Generation
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<form field mapped to a post meta key, e.g. lst_cost>' parameter in all versions up to, and including, 3.6.8 due to insufficient input s
- 7.2 High severity
JetFormBuilder — Dynamic Blocks Form Builder: Improper Neutralization of Input During Web Page Generation
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<any form field name — e.g. 'payload'>' parameter in all versions up to, and including, 3.6.7 due to insufficient input sanitization and
- 7.2 High severity
JetFormBuilder — Dynamic Blocks Form Builder: Improper Neutralization of Input During Web Page Generation
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action in all versions up to, and including, 3.6.5.4 due to insufficient input sanitization and out
- 7.2 High severity
Restaurant Menu and Food Ordering: Improper Neutralization of Input During Web Page Generation
The Restaurant Menu and Food Ordering plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'phone_number' parameter in all versions up to, and including, 2.4.14 due to insufficient input sanitization and output escaping. This makes it poss
- 9.8 Critical severity
JetFormBuilder — Dynamic Blocks Form Builder: Improper Privilege Management
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.6.2. This is due to the plugin not validating that a submitted form ID belongs to a JetFormBuilder form before p
- 7.2 High severity
MotoPress Hotel Booking: Improper Neutralization of Input During Web Page Generation
The MotoPress Hotel Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Stripe Webhook event object 'id' in all versions up to, and including, 6.2.4 due to insufficient input sanitization and output escaping. This makes it possibl
- 9.9 Critical severity
JetFormBuilder: Improper Control of Generation of Code
Improper Control of Generation of Code ('Code Injection') vulnerability in jetmonsters JetFormBuilder jetformbuilder allows Code Injection.This issue affects JetFormBuilder: from n/a through <= 3.5.6.1.
- 7.5 High severity
JetFormBuilder — Dynamic Blocks Form Builder: Absolute Path Traversal
The JetFormBuilder plugin for WordPress is vulnerable to arbitrary file read via path traversal in all versions up to, and including, 3.5.6.2. This is due to the 'Uploaded_File::set_from_array' method accepting user-supplied file paths from the Media Field pre
- 9.1 Critical severity
Hotel Booking Lite: Improper Control of Generation of Code
Improper Control of Generation of Code ('Code Injection') vulnerability in jetmonsters Hotel Booking Lite motopress-hotel-booking-lite allows Remote Code Inclusion.This issue affects Hotel Booking Lite: from n/a through <= 5.2.3.
- 7.2 High severity
JetFormBuilder: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in jetmonsters JetFormBuilder jetformbuilder allows Object Injection.This issue affects JetFormBuilder: from n/a through <= 3.5.1.2.
- 8.8 High severity
Restaurant Menu by MotoPress: Improper Control of Filename for Include/Require Statement in PHP Program
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jetmonsters Restaurant Menu by MotoPress mp-restaurant-menu allows PHP Local File Inclusion.This issue affects Restaurant Menu by MotoPress
- 7.2 High severity
JetFormBuilder — Dynamic Blocks Form Builder: Improper Privilege Management
The JetFormBuilder plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.3.4.1. This is due to improper restriction on user meta fields. This makes it possible for authenticated attackers, with administrator-level a
- 9.8 Critical severity
MotoPress Hotel Booking: Deserialization of Untrusted Data
The Hotel Booking Lite plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.11.1 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP cha
- 9.9 Critical severity
Timetable and Event Schedule by MotoPress: Improper Neutralization of Special Elements used in an SQL Command
The Timetable and Event Schedule by MotoPress plugin for WordPress is vulnerable to SQL Injection via the 'events' attribute of the 'mp-timetable' shortcode in all versions up to, and including, 2.4.11 due to insufficient escaping on the user supplied paramete
- 9.6 Critical severity
Getwid – Gutenberg Blocks: Server-Side Request Forgery
The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Server Side Request Forgery via the get_remote_content REST API endpoint in versions up to, and including, 1.8.3. This can allow authenticated attackers with subscriber-level permissions or ab