Jetmonsters
Monthly
Stored cross-site scripting in the JetFormBuilder - Dynamic Blocks Form Builder WordPress plugin through version 3.6.5.4 lets unauthenticated remote attackers plant arbitrary JavaScript that later executes in the browser of any visitor viewing an affected page. The payload is submitted through the plugin's public wp_ajax_nopriv_jet_form_builder_submit endpoint, persisted verbatim into post meta by the Insert/Update Post action, and rendered without escaping by a Select Field block whose options are populated by the get_from_db generator. No confirmed active exploitation or public exploit code has been identified at time of analysis, and the impact is constrained by configuration: the payload only fires on sites that combine a publicly submittable form with an Insert/Update Post action and a Select/get_from_db field bound to the poisoned meta key.
Cross-site scripting in the JetFormBuilder WordPress plugin through version 3.6.5.4 allows unauthenticated attackers to supply crafted JavaScript that executes in the browser of any user who views or interacts with the affected page or link; the reported vector (PR:N/UI:R/S:C, CWE-79) means no login is needed to deliver the payload, but a victim must still be lured into triggering it, and the scope change indicates the script runs with the authority of the host WordPress site rather than an isolated context. This is a moderate-severity web vulnerability rather than a critical, mass-exploitable one: the attacker gains no server-side code execution, only the ability to act within the victim's browser session, and there is no public exploit code and no confirmed active exploitation (CISA KEV) identified at time of analysis. The limiting factors are the mandatory user interaction and the low-impact, browser-context nature of the flaw.
Stored cross-site scripting in the MP Restaurant Menu and Food Ordering plugin for WordPress (all versions up to and including 2.4.14) lets an unauthenticated remote attacker inject arbitrary JavaScript by submitting a crafted value in the 'phone_number' field of the public ordering flow, with a CVSS:3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N). The payload is persisted in the order record and executes in the browser of whoever later opens the poisoned order in the site dashboard - typically an administrator or staff member - so real-world impact is gated by a privileged victim viewing attacker-controlled order data. Per the available intelligence, exploitation status is 'no public exploit identified at time of analysis' - there is no CISA KEV listing and no public proof-of-concept, and exploitation only requires the plugin to be active with its ordering/checkout functionality publicly reachable.
Unauthenticated privilege escalation in JetFormBuilder - Dynamic Blocks Form Builder plugin for WordPress (versions up to and including 3.6.2) allows remote attackers to create administrator-level user accounts on affected sites. The flaw stems from missing validation that a submitted form ID belongs to a JetFormBuilder form before parsing the referenced post's content as form schema and executing an Advanced Validation server-side callback, enabling arbitrary user creation with maximum privileges. No public exploit code has been identified at time of analysis, but the CVSS 9.8 critical rating and lack of authentication or user interaction make this a top-priority risk for any site running the vulnerable plugin.
Stored cross-site scripting in the MotoPress Hotel Booking premium Stripe gateway lets unauthenticated attackers plant persistent JavaScript in the plugin's payment log by POSTing forged Stripe webhook events, because the webhook listener only verifies the Stripe signature when an optional signing secret has been configured — and that secret is empty by default, so forged events are accepted without cryptographic verification. The attacker-controlled event object 'id' is written unescaped and later echoed unsanitized on the payment edit page, executing in an administrator's browser session. All versions up to and including 6.2.4 of the plugin (premium Stripe integration) are affected; no public exploit code has been identified at time of analysis, and no EPSS or CISA KEV data was supplied in the input.
Unauthenticated Local File Inclusion in the Restaurant Menu by MotoPress WordPress plugin (versions ≤ 2.4.11) exposes WordPress deployments to arbitrary local file disclosure and potential remote code execution via PHP file-inclusion chains. The CVSS vector (AV:N/AC:H/PR:N/UI:N) confirms network exploitation requires no authentication or user interaction, though the high-complexity rating indicates specific server-side conditions or path knowledge are needed to reliably trigger the flaw. No confirmed active exploitation appears in CISA KEV and no public exploit code has been identified at time of analysis.
Broken access control in the JetFormBuilder WordPress plugin (versions ≤ 3.6.4.1) allows unauthenticated remote attackers to perform privileged actions due to missing authorization checks (CWE-862), resulting in high integrity impact. Reported by Patchstack, the CVSS vector AV:N/AC:L/PR:N/UI:N confirms exploitation requires no authentication, no user interaction, and no special configuration beyond having the plugin installed and active. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated reflected/stored cross-site scripting in the JetFormBuilder WordPress plugin versions 3.6.0.1 and earlier allows remote attackers to inject script into pages rendered to victims. Exploitation requires a victim to interact with a crafted link or form (UI:R), and successful payload execution can hijack sessions or perform actions in the victim's browser context. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
A Code Injection vulnerability (CWE-94) exists in JetFormBuilder versions up to and including 3.5.6.1, allowing attackers to inject and execute arbitrary code within the application context. The vulnerability affects the JetFormBuilder plugin for WordPress across all versions through 3.5.6.1, and an attacker can leverage this to achieve Remote Code Execution (RCE) by injecting malicious code through form-processing mechanisms. Patchstack has documented this vulnerability with an assigned EUVD ID (EUVD-2026-15889), and while a CVSS score has not been formally assigned, the RCE classification indicates critical severity.
The JetFormBuilder plugin for WordPress contains a critical path traversal vulnerability allowing unauthenticated attackers to read arbitrary files from the server. All versions up to and including 3.5.6.2 are affected. Attackers can exploit this to exfiltrate sensitive local files as email attachments by submitting crafted form requests with malicious Media Field payloads, with a CVSS score of 7.5 indicating high confidentiality impact.
Reflected DOM-based cross-site scripting in the JetFormBuilder WordPress plugin (Dynamic Blocks Form Builder) affects all versions up to and including 3.6.6, allowing unauthenticated attackers to inject arbitrary web scripts via an attacker-chosen query variable whose name matches a form preset's query_var setting. Exploitation is heavily constrained: it requires a page that embeds a form containing a text field configured with a query_var Dynamic Preset together with a data-jfb-macro or JFB_FIELD:: macro reference to that field, and it also requires the victim to click an attacker-supplied link (UI:R), which is why the assessed CVSS is 4.7 with high attack complexity despite the network vector and no authentication requirement. There is no CISA KEV listing and no public exploit identified at time of analysis; the changeset in the plugin's Trac points to an upstream fix in trunk, but a patched tagged plugin release has not been independently confirmed.
Stored cross-site scripting in the Getwid - Gutenberg Blocks plugin for WordPress (all versions up to and including 3.0.1) allows authenticated attackers with contributor-level privileges or higher to inject arbitrary web scripts through the 'data-image-points' parameter, which are then stored and executed whenever another user - an editor, administrator, or site visitor - accesses the affected page. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N confirms the attacker needs a low-privileged authenticated account but requires no victim interaction to trigger the payload beyond viewing the injected page, and the changed scope indicates the script executes in the context of the broader site rather than the attacker's own content. No public exploit code has been identified at the time of analysis and there is no indication of confirmed active exploitation (CISA KEV), so practical exposure is concentrated on sites that provision contributor accounts to untrusted users or allow open registration; a site with only a single administrator and no contributor roles faces minimal real-world risk.
Reflected cross-site scripting in the JetFormBuilder - Dynamic Blocks Form Builder WordPress plugin (all versions up to and including 3.6.5.3) allows unauthenticated attackers to inject arbitrary JavaScript into a page by supplying a crafted 'jfb_xss' URL query variable that is carried into a Calculated Field. Exploitation is not automatic: the targeted site must host a form that pairs a URL Query Variable preset field with a Calculated Field referencing that preset, and the victim must be induced to click an attacker-crafted link (UI:R), so the realistically exploitable population is a subset of installs rather than every default configuration. There is no CISA KEV listing and no public exploit identified at time of analysis, and the independent assessment rates this as a genuine but moderate-severity issue rather than a top-priority emergency.
Stored cross-site scripting in the Getwid - Gutenberg Blocks WordPress plugin (all versions up to and including 2.1.3) allows authenticated attackers holding Contributor-level privileges or higher to inject arbitrary JavaScript through the Google Maps block's 'customStyle' attribute, because the frontend mapStyles() function passes that user-controlled value to eval(). The injected script is persisted in the post/block content and executes automatically in the browser of any visitor who renders the affected page, enabling session theft, content injection, or redirection under the site's origin (CVSS 6.4, Medium, with a Scope-Changed vector reflecting code execution outside the plugin's intended boundary). Exploitation requires a posting-capable account and no special non-default configuration; no public exploit code has been identified at time of analysis, and the issue is documented in a public Wordfence advisory.
Unauthenticated booking data tampering in MotoPress Appointment Booking for WordPress (all versions ≤ 2.4.4) allows remote attackers to overwrite the customer name, email, phone number, and customer_id of any victim booking that has not yet been confirmed. The REST endpoint POST /motopress/appointment/v1/bookings is registered with permission_callback set to '__return_true', bypassing all WordPress capability checks, and the createBooking handler blindly trusts an attacker-supplied payment_details.booking_id to load and persist an existing booking without any ownership verification (CWE-639). No public exploit code or CISA KEV listing is confirmed at time of analysis, but the attack is trivially executable by any unauthenticated network attacker given the also-public booking enumeration endpoint.
Sensitive subscriber data exposure in the Hotel Booking Lite WordPress plugin (versions 6.0.3 and earlier) allows authenticated low-privileged users to access confidential booking or guest information they should not be authorized to view. The vulnerability, classified under CWE-201, involves the plugin including sensitive data in API responses or rendered output accessible to subscriber-level WordPress accounts. No public exploit code or active exploitation has been identified at time of analysis, but the high confidentiality impact and low barrier to exploitation (only a subscriber account required) make patching a priority for any hospitality operator running this plugin.
Unauthorized wp_postmeta enumeration in JetFormBuilder (WordPress plugin, all versions through 3.6.3) allows unauthenticated remote attackers to extract arbitrary post meta values - including WooCommerce billing PII, payment tokens, and third-party plugin credentials - by exploiting a missing authorization check in the plugin's REST API generator endpoint. The flaw exists in the get_from_db generator function, which returns database values without verifying whether the requesting user is permitted to access them. No public exploit has been identified at time of analysis, but the attack is trivially executable against any site where a published JetFormBuilder form with a get_from_db field exists, as all required parameters (form ID, field name, generator ID) are discoverable by browsing the site's public forms.
SQL Injection in the MotoPress Appointment Booking WordPress plugin (versions ≤ 2.4.5) allows authenticated attackers holding the mpa_appointment_employee custom role to append arbitrary SQL to booking search queries via the 's' parameter, enabling full read access to the underlying WordPress database. The vulnerability originates in ManageBookingsPage.php at two separate query-construction points (lines 247 and 310), where user-supplied input is neither escaped nor parameterized. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS signal was not supplied; however, the Wordfence intelligence report and a confirmed upstream fix commit indicate the issue is credibly documented.
Stored cross-site scripting in JetWidgets For Elementor (versions up to and including 1.0.21) allows authenticated WordPress users holding author-level access or higher to plant persistent JavaScript payloads by supplying unsanitized input to the Animated Box widget's animation_effect parameter, which is written directly into an HTML class attribute without output escaping or server-side validation. Any site visitor who loads an injected page triggers the payload, enabling session hijacking, credential theft, or administrative account takeover through privilege escalation within the victim's browser context. No public exploit has been identified at time of analysis and the CVE does not appear in CISA KEV; however, a fix has been committed to the WordPress plugin repository.
Privilege escalation in JetFormBuilder WordPress plugin versions 3.6.1 and earlier allows authenticated subscribers to elevate their role to a higher-privileged level within the WordPress instance. The root cause is incorrect privilege assignment (CWE-266) in the plugin's form processing logic, enabling the lowest authenticated WordPress user role to gain unauthorized administrative or elevated access. No public exploit code or confirmed active exploitation has been identified at time of analysis; CVSS reflects high confidentiality and integrity impact if the high-complexity exploitation conditions are satisfied.
Insecure Direct Object Reference in the Timetable and Event Schedule by MotoPress WordPress plugin (all versions through 2.4.16) allows authenticated contributors to bypass object-level authorization and read non-public content belonging to other users. The vulnerability exists in the action_get_event_data AJAX action, which accepts a user-controlled timeslot key with no ownership or visibility validation, exposing full WP_Post data - including post_content, post_excerpt, post_status, and post_author - for draft, pending, and private mp-event posts. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Authorization bypass in MotoPress Hotel Booking plugin for WordPress (all versions through 6.0.1) allows unauthenticated remote attackers to overwrite or delete internal booking notes for any reservation by supplying an arbitrary booking ID. The root cause is a nonce that is unconditionally output into every public page's HTML via wp_localize_script under MPHB._data.nonces, meaning any site visitor - without an account or any prior interaction - can obtain a valid nonce and invoke the update-booking-notes AJAX action against any booking. No public exploit code has been identified at time of analysis, but the trivially accessible nonce makes this effectively zero-friction to abuse.
Stored cross-site scripting in the JetFormBuilder - Dynamic Blocks Form Builder WordPress plugin through version 3.6.5.4 lets unauthenticated remote attackers plant arbitrary JavaScript that later executes in the browser of any visitor viewing an affected page. The payload is submitted through the plugin's public wp_ajax_nopriv_jet_form_builder_submit endpoint, persisted verbatim into post meta by the Insert/Update Post action, and rendered without escaping by a Select Field block whose options are populated by the get_from_db generator. No confirmed active exploitation or public exploit code has been identified at time of analysis, and the impact is constrained by configuration: the payload only fires on sites that combine a publicly submittable form with an Insert/Update Post action and a Select/get_from_db field bound to the poisoned meta key.
Cross-site scripting in the JetFormBuilder WordPress plugin through version 3.6.5.4 allows unauthenticated attackers to supply crafted JavaScript that executes in the browser of any user who views or interacts with the affected page or link; the reported vector (PR:N/UI:R/S:C, CWE-79) means no login is needed to deliver the payload, but a victim must still be lured into triggering it, and the scope change indicates the script runs with the authority of the host WordPress site rather than an isolated context. This is a moderate-severity web vulnerability rather than a critical, mass-exploitable one: the attacker gains no server-side code execution, only the ability to act within the victim's browser session, and there is no public exploit code and no confirmed active exploitation (CISA KEV) identified at time of analysis. The limiting factors are the mandatory user interaction and the low-impact, browser-context nature of the flaw.
Stored cross-site scripting in the MP Restaurant Menu and Food Ordering plugin for WordPress (all versions up to and including 2.4.14) lets an unauthenticated remote attacker inject arbitrary JavaScript by submitting a crafted value in the 'phone_number' field of the public ordering flow, with a CVSS:3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N). The payload is persisted in the order record and executes in the browser of whoever later opens the poisoned order in the site dashboard - typically an administrator or staff member - so real-world impact is gated by a privileged victim viewing attacker-controlled order data. Per the available intelligence, exploitation status is 'no public exploit identified at time of analysis' - there is no CISA KEV listing and no public proof-of-concept, and exploitation only requires the plugin to be active with its ordering/checkout functionality publicly reachable.
Unauthenticated privilege escalation in JetFormBuilder - Dynamic Blocks Form Builder plugin for WordPress (versions up to and including 3.6.2) allows remote attackers to create administrator-level user accounts on affected sites. The flaw stems from missing validation that a submitted form ID belongs to a JetFormBuilder form before parsing the referenced post's content as form schema and executing an Advanced Validation server-side callback, enabling arbitrary user creation with maximum privileges. No public exploit code has been identified at time of analysis, but the CVSS 9.8 critical rating and lack of authentication or user interaction make this a top-priority risk for any site running the vulnerable plugin.
Stored cross-site scripting in the MotoPress Hotel Booking premium Stripe gateway lets unauthenticated attackers plant persistent JavaScript in the plugin's payment log by POSTing forged Stripe webhook events, because the webhook listener only verifies the Stripe signature when an optional signing secret has been configured — and that secret is empty by default, so forged events are accepted without cryptographic verification. The attacker-controlled event object 'id' is written unescaped and later echoed unsanitized on the payment edit page, executing in an administrator's browser session. All versions up to and including 6.2.4 of the plugin (premium Stripe integration) are affected; no public exploit code has been identified at time of analysis, and no EPSS or CISA KEV data was supplied in the input.
Unauthenticated Local File Inclusion in the Restaurant Menu by MotoPress WordPress plugin (versions ≤ 2.4.11) exposes WordPress deployments to arbitrary local file disclosure and potential remote code execution via PHP file-inclusion chains. The CVSS vector (AV:N/AC:H/PR:N/UI:N) confirms network exploitation requires no authentication or user interaction, though the high-complexity rating indicates specific server-side conditions or path knowledge are needed to reliably trigger the flaw. No confirmed active exploitation appears in CISA KEV and no public exploit code has been identified at time of analysis.
Broken access control in the JetFormBuilder WordPress plugin (versions ≤ 3.6.4.1) allows unauthenticated remote attackers to perform privileged actions due to missing authorization checks (CWE-862), resulting in high integrity impact. Reported by Patchstack, the CVSS vector AV:N/AC:L/PR:N/UI:N confirms exploitation requires no authentication, no user interaction, and no special configuration beyond having the plugin installed and active. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated reflected/stored cross-site scripting in the JetFormBuilder WordPress plugin versions 3.6.0.1 and earlier allows remote attackers to inject script into pages rendered to victims. Exploitation requires a victim to interact with a crafted link or form (UI:R), and successful payload execution can hijack sessions or perform actions in the victim's browser context. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
A Code Injection vulnerability (CWE-94) exists in JetFormBuilder versions up to and including 3.5.6.1, allowing attackers to inject and execute arbitrary code within the application context. The vulnerability affects the JetFormBuilder plugin for WordPress across all versions through 3.5.6.1, and an attacker can leverage this to achieve Remote Code Execution (RCE) by injecting malicious code through form-processing mechanisms. Patchstack has documented this vulnerability with an assigned EUVD ID (EUVD-2026-15889), and while a CVSS score has not been formally assigned, the RCE classification indicates critical severity.
The JetFormBuilder plugin for WordPress contains a critical path traversal vulnerability allowing unauthenticated attackers to read arbitrary files from the server. All versions up to and including 3.5.6.2 are affected. Attackers can exploit this to exfiltrate sensitive local files as email attachments by submitting crafted form requests with malicious Media Field payloads, with a CVSS score of 7.5 indicating high confidentiality impact.
Reflected DOM-based cross-site scripting in the JetFormBuilder WordPress plugin (Dynamic Blocks Form Builder) affects all versions up to and including 3.6.6, allowing unauthenticated attackers to inject arbitrary web scripts via an attacker-chosen query variable whose name matches a form preset's query_var setting. Exploitation is heavily constrained: it requires a page that embeds a form containing a text field configured with a query_var Dynamic Preset together with a data-jfb-macro or JFB_FIELD:: macro reference to that field, and it also requires the victim to click an attacker-supplied link (UI:R), which is why the assessed CVSS is 4.7 with high attack complexity despite the network vector and no authentication requirement. There is no CISA KEV listing and no public exploit identified at time of analysis; the changeset in the plugin's Trac points to an upstream fix in trunk, but a patched tagged plugin release has not been independently confirmed.
Stored cross-site scripting in the Getwid - Gutenberg Blocks plugin for WordPress (all versions up to and including 3.0.1) allows authenticated attackers with contributor-level privileges or higher to inject arbitrary web scripts through the 'data-image-points' parameter, which are then stored and executed whenever another user - an editor, administrator, or site visitor - accesses the affected page. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N confirms the attacker needs a low-privileged authenticated account but requires no victim interaction to trigger the payload beyond viewing the injected page, and the changed scope indicates the script executes in the context of the broader site rather than the attacker's own content. No public exploit code has been identified at the time of analysis and there is no indication of confirmed active exploitation (CISA KEV), so practical exposure is concentrated on sites that provision contributor accounts to untrusted users or allow open registration; a site with only a single administrator and no contributor roles faces minimal real-world risk.
Reflected cross-site scripting in the JetFormBuilder - Dynamic Blocks Form Builder WordPress plugin (all versions up to and including 3.6.5.3) allows unauthenticated attackers to inject arbitrary JavaScript into a page by supplying a crafted 'jfb_xss' URL query variable that is carried into a Calculated Field. Exploitation is not automatic: the targeted site must host a form that pairs a URL Query Variable preset field with a Calculated Field referencing that preset, and the victim must be induced to click an attacker-crafted link (UI:R), so the realistically exploitable population is a subset of installs rather than every default configuration. There is no CISA KEV listing and no public exploit identified at time of analysis, and the independent assessment rates this as a genuine but moderate-severity issue rather than a top-priority emergency.
Stored cross-site scripting in the Getwid - Gutenberg Blocks WordPress plugin (all versions up to and including 2.1.3) allows authenticated attackers holding Contributor-level privileges or higher to inject arbitrary JavaScript through the Google Maps block's 'customStyle' attribute, because the frontend mapStyles() function passes that user-controlled value to eval(). The injected script is persisted in the post/block content and executes automatically in the browser of any visitor who renders the affected page, enabling session theft, content injection, or redirection under the site's origin (CVSS 6.4, Medium, with a Scope-Changed vector reflecting code execution outside the plugin's intended boundary). Exploitation requires a posting-capable account and no special non-default configuration; no public exploit code has been identified at time of analysis, and the issue is documented in a public Wordfence advisory.
Unauthenticated booking data tampering in MotoPress Appointment Booking for WordPress (all versions ≤ 2.4.4) allows remote attackers to overwrite the customer name, email, phone number, and customer_id of any victim booking that has not yet been confirmed. The REST endpoint POST /motopress/appointment/v1/bookings is registered with permission_callback set to '__return_true', bypassing all WordPress capability checks, and the createBooking handler blindly trusts an attacker-supplied payment_details.booking_id to load and persist an existing booking without any ownership verification (CWE-639). No public exploit code or CISA KEV listing is confirmed at time of analysis, but the attack is trivially executable by any unauthenticated network attacker given the also-public booking enumeration endpoint.
Sensitive subscriber data exposure in the Hotel Booking Lite WordPress plugin (versions 6.0.3 and earlier) allows authenticated low-privileged users to access confidential booking or guest information they should not be authorized to view. The vulnerability, classified under CWE-201, involves the plugin including sensitive data in API responses or rendered output accessible to subscriber-level WordPress accounts. No public exploit code or active exploitation has been identified at time of analysis, but the high confidentiality impact and low barrier to exploitation (only a subscriber account required) make patching a priority for any hospitality operator running this plugin.
Unauthorized wp_postmeta enumeration in JetFormBuilder (WordPress plugin, all versions through 3.6.3) allows unauthenticated remote attackers to extract arbitrary post meta values - including WooCommerce billing PII, payment tokens, and third-party plugin credentials - by exploiting a missing authorization check in the plugin's REST API generator endpoint. The flaw exists in the get_from_db generator function, which returns database values without verifying whether the requesting user is permitted to access them. No public exploit has been identified at time of analysis, but the attack is trivially executable against any site where a published JetFormBuilder form with a get_from_db field exists, as all required parameters (form ID, field name, generator ID) are discoverable by browsing the site's public forms.
SQL Injection in the MotoPress Appointment Booking WordPress plugin (versions ≤ 2.4.5) allows authenticated attackers holding the mpa_appointment_employee custom role to append arbitrary SQL to booking search queries via the 's' parameter, enabling full read access to the underlying WordPress database. The vulnerability originates in ManageBookingsPage.php at two separate query-construction points (lines 247 and 310), where user-supplied input is neither escaped nor parameterized. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS signal was not supplied; however, the Wordfence intelligence report and a confirmed upstream fix commit indicate the issue is credibly documented.
Stored cross-site scripting in JetWidgets For Elementor (versions up to and including 1.0.21) allows authenticated WordPress users holding author-level access or higher to plant persistent JavaScript payloads by supplying unsanitized input to the Animated Box widget's animation_effect parameter, which is written directly into an HTML class attribute without output escaping or server-side validation. Any site visitor who loads an injected page triggers the payload, enabling session hijacking, credential theft, or administrative account takeover through privilege escalation within the victim's browser context. No public exploit has been identified at time of analysis and the CVE does not appear in CISA KEV; however, a fix has been committed to the WordPress plugin repository.
Privilege escalation in JetFormBuilder WordPress plugin versions 3.6.1 and earlier allows authenticated subscribers to elevate their role to a higher-privileged level within the WordPress instance. The root cause is incorrect privilege assignment (CWE-266) in the plugin's form processing logic, enabling the lowest authenticated WordPress user role to gain unauthorized administrative or elevated access. No public exploit code or confirmed active exploitation has been identified at time of analysis; CVSS reflects high confidentiality and integrity impact if the high-complexity exploitation conditions are satisfied.
Insecure Direct Object Reference in the Timetable and Event Schedule by MotoPress WordPress plugin (all versions through 2.4.16) allows authenticated contributors to bypass object-level authorization and read non-public content belonging to other users. The vulnerability exists in the action_get_event_data AJAX action, which accepts a user-controlled timeslot key with no ownership or visibility validation, exposing full WP_Post data - including post_content, post_excerpt, post_status, and post_author - for draft, pending, and private mp-event posts. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Authorization bypass in MotoPress Hotel Booking plugin for WordPress (all versions through 6.0.1) allows unauthenticated remote attackers to overwrite or delete internal booking notes for any reservation by supplying an arbitrary booking ID. The root cause is a nonce that is unconditionally output into every public page's HTML via wp_localize_script under MPHB._data.nonces, meaning any site visitor - without an account or any prior interaction - can obtain a valid nonce and invoke the update-booking-notes AJAX action against any booking. No public exploit code has been identified at time of analysis, but the trivially accessible nonce makes this effectively zero-friction to abuse.