Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

jetmonsters — Vulnerabilities & Security Advisories 55

Browse all 55 CVE security advisories affecting jetmonsters. AI-powered Chinese analysis, POCs, and references for each vulnerability.

Jetmonsters operates as a software development entity, primarily focusing on creating digital assets and applications for the gaming and entertainment sectors. Security audits have identified thirty-five distinct Common Vulnerabilities and Exposures (CVEs) associated with its products, highlighting significant historical weaknesses in code quality and implementation. The most prevalent vulnerability classes include remote code execution (RCE), cross-site scripting (XSS), and privilege escalation flaws, which often stem from insufficient input validation and improper access controls. These defects have occasionally allowed attackers to compromise system integrity or access sensitive user data without authorization. While no single catastrophic incident has defined the company’s public record, the cumulative volume of disclosed CVEs suggests a pattern of recurring security oversights. This trend underscores the necessity for rigorous static analysis and continuous integration security testing to mitigate risks before deployment.

CVE ID Title CVSS Severity Published
CVE-2026-97342 JetFormBuilder <= 3.6.5.4 - Unauthenticated Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action — JetFormBuilder — Dynamic Blocks Form Builder CWE-79 7.2 High 2026-10-02
CVE-2026-102391 WordPress JetFormBuilder plugin <= 3.6.5.4 - Cross Site Scripting (XSS) vulnerability — JetFormBuilder CWE-79 7.1 High 2026-09-30
CVE-2026-96568 Restaurant Menu and Food Ordering <= 2.4.14 - Unauthenticated Stored Cross-Site Scripting via 'phone_number' Parameter — Restaurant Menu and Food Ordering CWE-79 7.2 High 2026-09-25
CVE-2026-92212 JetFormBuilder <= 3.6.5.3 - Reflected Cross-Site Scripting via 'jfb_xss' (URL Query Variable) Parameter via Calculated Field — JetFormBuilder — Dynamic Blocks Form Builder CWE-79 6.1 Medium 2026-09-25
CVE-2026-5924 Getwid <= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Google Maps 'customStyle' — Getwid – Gutenberg Blocks CWE-79 6.4 Medium 2026-09-23
CVE-2026-12793 JetFormBuilder <= 3.6.2 - Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' Parameter — JetFormBuilder — Dynamic Blocks Form Builder CWE-269 9.8 Critical 2026-09-16
CVE-2026-90650 MotoPress Hotel Booking <= 6.2.4 - Unauthenticated Stored Cross-Site Scripting via Stripe Webhook Event Object 'id' — MotoPress Hotel Booking CWE-79 7.2 High 2026-09-15
CVE-2026-73400 WordPress Restaurant Menu by MotoPress plugin <= 2.4.11 - Local File Inclusion vulnerability — Restaurant Menu by MotoPress CWE-98 8.1 High 2026-08-18
CVE-2026-28140 WordPress JetFormBuilder plugin <= 3.6.4.1 - Broken Access Control vulnerability — JetFormBuilder CWE-862 7.5 High 2026-08-06
CVE-2026-9180 MotoPress Appointment Booking <= 2.4.4 - Unauthenticated Insecure Direct Object Reference to 'payment_details.booking_id' Parameter — MotoPress Appointment Booking CWE-639 5.3 Medium 2026-07-03
CVE-2026-57347 WordPress Hotel Booking Lite plugin <= 6.0.3 - Sensitive Data Exposure vulnerability — Hotel Booking Lite CWE-201 6.5 Medium 2026-07-02
CVE-2026-13459 JetFormBuilder <= 3.6.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'context' Parameter — JetFormBuilder — Dynamic Blocks Form Builder CWE-862 5.3 Medium 2026-07-02
CVE-2026-13454 MotoPress Appointment Booking <= 2.4.5 - Authenticated (Staff+) SQL Injection via 's' Parameter — MotoPress Appointment Booking CWE-89 6.5 Medium 2026-07-01
CVE-2026-11380 JetWidgets For Elementor <= 1.0.21 - Authenticated (Author+) Stored Cross-Site Scripting via Animated Box 'animation_effect' Setting — JetWidgets For Elementor CWE-79 6.4 Medium 2026-07-01
CVE-2026-57644 WordPress Restaurant Menu by MotoPress plugin <= 2.4.10 - SQL Injection vulnerability — Restaurant Menu by MotoPress CWE-89 8.5 High 2026-06-26
CVE-2025-63078 WordPress Restaurant Menu by MotoPress plugin <= 2.4.11 - Broken Access Control vulnerability — Restaurant Menu by MotoPress CWE-862 4.3 Medium 2026-06-26
CVE-2026-54196 WordPress JetFormBuilder plugin <= 3.6.1 - Privilege Escalation vulnerability — JetFormBuilder CWE-266 6.8 Medium 2026-06-17
CVE-2026-54195 WordPress JetFormBuilder plugin <= 3.6.0.1 - Cross Site Scripting (XSS) vulnerability — JetFormBuilder CWE-79 7.1 High 2026-06-17
CVE-2026-9228 Timetable and Event Schedule by MotoPress <= 2.4.16 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via action_get_event_data Function — Timetable and Event Schedule by MotoPress CWE-639 4.3 Medium 2026-05-28
CVE-2026-8684 MotoPress Hotel Booking <= 6.0.1 - Missing Authorization to Unauthenticated Arbitrary Booking Notes Modification via mphb_update_booking_notes AJAX Action — MotoPress Hotel Booking CWE-862 5.3 Medium 2026-05-22
CVE-2026-32525 WordPress JetFormBuilder plugin <= 3.5.6.1 - Remote Code Execution (RCE) vulnerability — JetFormBuilder CWE-94 9.9 Critical 2026-03-25
CVE-2026-4373 JetFormBuilder <= 3.5.6.2 - Unauthenticated Arbitrary File Read via Media Field — JetFormBuilder — Dynamic Blocks Form Builder CWE-36 7.5 High 2026-03-21
CVE-2025-69013 WordPress Stratum plugin <= 1.6.1 - Broken Access Control vulnerability — Stratum CWE-862 4.3 Medium 2025-12-30
CVE-2025-66078 WordPress Hotel Booking Lite plugin <= 5.2.3 - Remote Code Execution (RCE) vulnerability — Hotel Booking Lite CWE-94 9.1 Critical 2025-12-18
CVE-2025-49914 WordPress Restaurant Menu by MotoPress plugin <= 2.4.7 - Sensitive Data Exposure vulnerability — Restaurant Menu by MotoPress CWE-497 6.5 Medium 2025-12-18
CVE-2025-11991 JetFormBuilder <= 3.5.3 - Missing Authorization to Unauthenticated Form Generation — JetFormBuilder — Dynamic Blocks Form Builder CWE-862 5.3 Medium 2025-12-16
CVE-2025-8195 JetWidgets For Elementor <= 1.0.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Comparison and Subscribe Widgets — JetWidgets For Elementor CWE-79 6.4 Medium 2025-12-13
CVE-2025-64384 WordPress JetFormBuilder plugin <= 3.5.3 - Broken Access Control vulnerability — JetFormBuilder CWE-862 5.3 Medium 2025-11-13
CVE-2025-58252 WordPress Getwid Plugin <= 2.1.2 - Sensitive Data Exposure Vulnerability — Getwid CWE-201 4.3 Medium 2025-09-22
CVE-2025-7845 Stratum – Elementor Widgets <= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Google Maps and Image Hotspot Widgets — Stratum Widgets for Elementor CWE-79 6.4 Medium 2025-08-01

This page lists every published CVE security advisory associated with jetmonsters. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.