Jetmonsters vulnerabilities
60 published CVEs name Jetmonsters among the affected products.
- Published CVEs
- 60
- Last 12 months
- 31
- Critical
- 5
- Known exploited
- 0
Critical 5High 14Medium 41Low 0Not scored 0
CVEs per yearBy the year they were published
- 20233
- 202419
- 202513
- 202625
Newest CVEs
- CVE-2026-120561
JetFormBuilder <= 3.6.2 - Missing Authorization to Unauthenticated JetEngine Options Page Modification
jetmonsters · JetFormBuilder — Dynamic Blocks Form Builder
Medium5.3 - CVE-2026-103912
JetFormBuilder <= 3.6.6 - Reflected DOM-Based Cross-Site Scripting via 'query_var' Dynamic Preset via data-jfb-macro / JFB_FIELD:: Macro Renderer
jetmonsters · JetFormBuilder — Dynamic Blocks Form Builder
Medium4.7 - CVE-2026-91862
Getwid <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-image-points'
jetmonsters · Getwid – Gutenberg Blocks
Medium6.4 - CVE-2026-97342
JetFormBuilder <= 3.6.5.4 - Unauthenticated Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action
jetmonsters · JetFormBuilder — Dynamic Blocks Form Builder
High7.2 - CVE-2026-102391
WordPress JetFormBuilder plugin <= 3.6.5.4 - Cross Site Scripting (XSS) vulnerability
jetmonsters · JetFormBuilder
High7.1 - CVE-2026-96568
Restaurant Menu and Food Ordering <= 2.4.14 - Unauthenticated Stored Cross-Site Scripting via 'phone_number' Parameter
jetmonsters · Restaurant Menu and Food Ordering
High7.2 - CVE-2026-92212
JetFormBuilder <= 3.6.5.3 - Reflected Cross-Site Scripting via 'jfb_xss' (URL Query Variable) Parameter via Calculated Field
jetmonsters · JetFormBuilder — Dynamic Blocks Form Builder
Medium6.1 - CVE-2026-5924
Getwid <= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Google Maps 'customStyle'
jetmonsters · Getwid – Gutenberg Blocks
Medium6.4 - CVE-2026-12793
JetFormBuilder <= 3.6.2 - Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' Parameter
jetmonsters · JetFormBuilder — Dynamic Blocks Form Builder
Critical9.8 - CVE-2026-90650
MotoPress Hotel Booking <= 6.2.4 - Unauthenticated Stored Cross-Site Scripting via Stripe Webhook Event Object 'id'
jetmonsters · MotoPress Hotel Booking
High7.2
Products with the most CVEs
Most common weaknesses
- CWE-79 Cross-site scripting (XSS)23
- CWE-862 Missing authorization12
- CWE-352 Cross-site request forgery (CSRF)3
- CWE-89 SQL injection3
- CWE-201 2
- CWE-269 Improper privilege management2
- CWE-502 Deserialization of untrusted data2
- CWE-639 Authorization bypass through a user-controlled key (IDOR)2
- CWE-94 Code injection2
- CWE-98 PHP remote file inclusion2