Skip to content
OpenAdvisories

Vendor

jetmonsters

64 known vulnerabilities.

Products

Getwid – Gutenberg Blocks 12 JetFormBuilder — Dynamic Blocks Form Builder 12 JetWidgets For Elementor 7 JetFormBuilder 7 Restaurant Menu by MotoPress 6 Stratum Widgets for Elementor 4 MotoPress Hotel Booking 3 Timetable and Event Schedule by MotoPress 3 MotoPress Appointment Booking 3 Hotel Booking Lite 2 Getwid 1 Emmet Lite 1 Restaurant Menu and Food Ordering 1 Stratum 1 Mega Menu Block 1
All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-12793 Public exploit

    JetFormBuilder <= 3.6.2 - Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' Parameter

    The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.6.2. This is due to the plugin not validating that a submitted form ID belongs to a JetFormBuilder form before …

    jetmonsters JetFormBuilder — Dynamic Blocks Form Builder Web / CMS
  • Critical 9.9
    CVE-2026-32525

    WordPress JetFormBuilder plugin <= 3.5.6.1 - Remote Code Execution (RCE) vulnerability

    Improper Control of Generation of Code ('Code Injection') vulnerability in jetmonsters JetFormBuilder jetformbuilder allows Code Injection.This issue affects JetFormBuilder: from n/a through <= 3.5.6.1.

    jetmonsters JetFormBuilder
  • Critical 9.1
    CVE-2025-66078

    WordPress Hotel Booking Lite plugin <= 5.2.3 - Remote Code Execution (RCE) vulnerability

    Improper Control of Generation of Code ('Code Injection') vulnerability in jetmonsters Hotel Booking Lite motopress-hotel-booking-lite allows Remote Code Inclusion.This issue affects Hotel Booking Lite: from n/a through <= 5.2.3.

    jetmonsters Hotel Booking Lite
  • Critical 9.8
    CVE-2024-4413

    Hotel Booking Lite <= 4.11.1 - Unauthenticated PHP Object Injection

    The Hotel Booking Lite plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.11.1 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP ch…

    jetmonsters MotoPress Hotel Booking Web / CMS
  • Critical 9.9
    CVE-2024-3342

    Timetable and Event Schedule by MotoPress <= 2.4.11 - Authenticated (Contributor+) SQL Injection

    The Timetable and Event Schedule by MotoPress plugin for WordPress is vulnerable to SQL Injection via the 'events' attribute of the 'mp-timetable' shortcode in all versions up to, and including, 2.4.11 due to insufficient escaping on the user supplied paramet…

    jetmonsters Timetable and Event Schedule by MotoPress Web / CMS