Skip to content
CVE Tracker
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage

Jetmonsters vulnerabilities

60 published CVEs name Jetmonsters among the affected products.

Published CVEs
60
Last 12 months
31
Critical
5
Known exploited
0

Critical 5High 14Medium 41Low 0Not scored 0

CVEs per yearBy the year they were published

  1. 20233
  2. 202419
  3. 202513
  4. 202625

Newest CVEs

  • CVE-2026-120561

    JetFormBuilder <= 3.6.2 - Missing Authorization to Unauthenticated JetEngine Options Page Modification

    jetmonsters · JetFormBuilder — Dynamic Blocks Form Builder

    Medium5.3
  • CVE-2026-103912

    JetFormBuilder <= 3.6.6 - Reflected DOM-Based Cross-Site Scripting via 'query_var' Dynamic Preset via data-jfb-macro / JFB_FIELD:: Macro Renderer

    jetmonsters · JetFormBuilder — Dynamic Blocks Form Builder

    Medium4.7
  • CVE-2026-91862

    Getwid <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-image-points'

    jetmonsters · Getwid – Gutenberg Blocks

    Medium6.4
  • CVE-2026-97342

    JetFormBuilder <= 3.6.5.4 - Unauthenticated Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action

    jetmonsters · JetFormBuilder — Dynamic Blocks Form Builder

    High7.2
  • CVE-2026-102391

    WordPress JetFormBuilder plugin <= 3.6.5.4 - Cross Site Scripting (XSS) vulnerability

    jetmonsters · JetFormBuilder

    High7.1
  • CVE-2026-96568

    Restaurant Menu and Food Ordering <= 2.4.14 - Unauthenticated Stored Cross-Site Scripting via 'phone_number' Parameter

    jetmonsters · Restaurant Menu and Food Ordering

    High7.2
  • CVE-2026-92212

    JetFormBuilder <= 3.6.5.3 - Reflected Cross-Site Scripting via 'jfb_xss' (URL Query Variable) Parameter via Calculated Field

    jetmonsters · JetFormBuilder — Dynamic Blocks Form Builder

    Medium6.1
  • CVE-2026-5924

    Getwid <= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Google Maps 'customStyle'

    jetmonsters · Getwid – Gutenberg Blocks

    Medium6.4
  • CVE-2026-12793

    JetFormBuilder <= 3.6.2 - Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' Parameter

    jetmonsters · JetFormBuilder — Dynamic Blocks Form Builder

    Critical9.8
  • CVE-2026-90650

    MotoPress Hotel Booking <= 6.2.4 - Unauthenticated Stored Cross-Site Scripting via Stripe Webhook Event Object 'id'

    jetmonsters · MotoPress Hotel Booking

    High7.2