CVE-2026-73400WordPress Restaurant Menu by MotoPress plugin <= 2.4.11 - Local File Inclusion vulnerability Exploitation status Not known exploited Fix Affected product R Restaurant Menu by MotoPress Published 08/18/2026 Severity High CVE-2026-28140WordPress JetFormBuilder plugin <= 3.6.4.1 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product J JetFormBuilder Published 08/06/2026 Severity High CVE-2026-9180MotoPress Appointment Booking <= 2.4.4 - Unauthenticated Insecure Direct Object Reference to 'payment_details.booking_id' Parameter Exploitation status Not known exploited Fix Affected product M MotoPress Appointment Booking Published 07/03/2026 Severity Medium CVE-2026-57347WordPress Hotel Booking Lite plugin <= 6.0.3 - Sensitive Data Exposure vulnerability Exploitation status Not known exploited Fix Affected product H Hotel Booking Lite Published 07/02/2026 Severity Medium CVE-2026-13459JetFormBuilder <= 3.6.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'context' Parameter Exploitation status Not known exploited Fix Affected product J JetFormBuilder — Dynamic Blocks Form Builder Published 07/02/2026 Severity Medium CVE-2026-13454MotoPress Appointment Booking <= 2.4.5 - Authenticated (Staff+) SQL Injection via 's' Parameter Exploitation status Not known exploited Fix Affected product M MotoPress Appointment Booking Published 07/01/2026 Severity Medium CVE-2026-11380JetWidgets For Elementor <= 1.0.21 - Authenticated (Author+) Stored Cross-Site Scripting via Animated Box 'animation_effect' Setting Exploitation status Not known exploited Fix Affected product J JetWidgets For Elementor Published 07/01/2026 Severity Medium CVE-2026-57644WordPress Restaurant Menu by MotoPress plugin <= 2.4.10 - SQL Injection vulnerability Exploitation status Not known exploited Fix Affected product R Restaurant Menu by MotoPress Published 06/26/2026 Severity High CVE-2025-63078WordPress Restaurant Menu by MotoPress plugin <= 2.4.11 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product R Restaurant Menu by MotoPress Published 06/26/2026 Severity Medium CVE-2026-54196WordPress JetFormBuilder plugin <= 3.6.1 - Privilege Escalation vulnerability Exploitation status Not known exploited Fix Affected product J JetFormBuilder Published 06/17/2026 Severity Medium CVE-2026-54195WordPress JetFormBuilder plugin <= 3.6.0.1 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product J JetFormBuilder Published 06/17/2026 Severity High CVE-2026-9228Timetable and Event Schedule by MotoPress <= 2.4.16 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via action_get_event_data Function Exploitation status Not known exploited Fix Affected product T Timetable and Event Schedule by MotoPress Published 05/28/2026 Severity Medium CVE-2026-8684MotoPress Hotel Booking <= 6.0.1 - Missing Authorization to Unauthenticated Arbitrary Booking Notes Modification via mphb_update_booking_notes AJAX Action Exploitation status Not known exploited Fix Affected product M MotoPress Hotel Booking Published 05/22/2026 Severity Medium CVE-2026-32525WordPress JetFormBuilder plugin <= 3.5.6.1 - Remote Code Execution (RCE) vulnerability Exploitation status Not known exploited Fix Affected product J JetFormBuilder Published 03/25/2026 Severity Critical CVE-2026-4373JetFormBuilder <= 3.5.6.2 - Unauthenticated Arbitrary File Read via Media Field Exploitation status Not known exploited Fix Affected product J JetFormBuilder — Dynamic Blocks Form Builder Published 03/21/2026 Severity High CVE-2025-69013WordPress Stratum plugin <= 1.6.1 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product S Stratum Published 12/30/2025 Severity Medium CVE-2025-66078WordPress Hotel Booking Lite plugin <= 5.2.3 - Remote Code Execution (RCE) vulnerability Exploitation status Not known exploited Fix Affected product H Hotel Booking Lite Published 12/18/2025 Severity Critical CVE-2025-49914WordPress Restaurant Menu by MotoPress plugin <= 2.4.7 - Sensitive Data Exposure vulnerability Exploitation status Not known exploited Fix Affected product R Restaurant Menu by MotoPress Published 12/18/2025 Severity Medium CVE-2025-11991JetFormBuilder <= 3.5.3 - Missing Authorization to Unauthenticated Form Generation Exploitation status Not known exploited Fix Affected product J JetFormBuilder — Dynamic Blocks Form Builder Published 12/16/2025 Severity Medium CVE-2025-8195JetWidgets For Elementor <= 1.0.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Comparison and Subscribe Widgets Exploitation status Not known exploited Fix Affected product J JetWidgets For Elementor Published 12/13/2025 Severity Medium CVE-2025-64384WordPress JetFormBuilder plugin <= 3.5.3 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product J JetFormBuilder Published 11/13/2025 Severity Medium CVE-2025-58252WordPress Getwid Plugin <= 2.1.2 - Sensitive Data Exposure Vulnerability Exploitation status Not known exploited Fix Affected product G Getwid Published 09/22/2025 Severity Medium CVE-2025-7845Stratum – Elementor Widgets <= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Google Maps and Image Hotspot Widgets Exploitation status Not known exploited Fix Affected product S Stratum Widgets for Elementor Published 08/01/2025 Severity Medium CVE-2025-54038WordPress Restaurant Menu by MotoPress plugin <= 2.4.6 - Cross Site Request Forgery (CSRF) Vulnerability Exploitation status Not known exploited Fix Affected product R Restaurant Menu by MotoPress Published 07/16/2025 Severity Medium CVE-2025-53990WordPress JetFormBuilder plugin <= 3.5.1.2 - PHP Object Injection Vulnerability Exploitation status Not known exploited Fix Affected product J JetFormBuilder Published 07/16/2025 Severity High CVE-2025-48258WordPress Mega Menu Block plugin <= 1.0.6 - Cross Site Scripting (XSS) Vulnerability Exploitation status Not known exploited Fix Affected product M Mega Menu Block Published 05/19/2025 Severity Medium CVE-2025-30846WordPress Restaurant Menu by MotoPress plugin <= 2.4.4 - Local File Inclusion vulnerability Exploitation status Not known exploited Fix Affected product R Restaurant Menu by MotoPress Published 03/27/2025 Severity High CVE-2024-13642Stratum – Elementor Widgets <= 1.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting Vulnerability via Image Hotspot Widget Exploitation status Not known exploited Fix Affected product S Stratum Widgets for Elementor Published 01/30/2025 Severity Medium CVE-2024-5020Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library Exploitation status Not known exploited Fix Affected product G Getwid – Gutenberg Blocks Published 12/04/2024 Severity Medium CVE-2024-10316Stratum – Elementor Widgets <= 1.4.4 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates Exploitation status Not known exploited Fix Affected product S Stratum Widgets for Elementor Published 11/21/2024 Severity Medium CVE-2024-10872Getwid – Gutenberg Blocks <= 2.0.12 - Authenticated (Contributor+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product G Getwid – Gutenberg Blocks Published 11/20/2024 Severity Medium CVE-2024-10323JetWidgets For Elementor <= 1.0.18 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload Exploitation status Not known exploited Fix Affected product J JetWidgets For Elementor Published 11/12/2024 Severity Medium CVE-2020-36840Timetable and Event Schedule by MotoPress <= 2.3.8 - Missing Authorization Exploitation status Not known exploited Fix Affected product T Timetable and Event Schedule by MotoPress Published 10/16/2024 Severity High CVE-2024-7291JetFormBuilder <= 3.3.4.1 - Authenticated (Administrator+) Privilege Escalation Exploitation status Not known exploited Fix Affected product J JetFormBuilder — Dynamic Blocks Form Builder Published 08/03/2024 Severity High CVE-2024-6489Getwid – Gutenberg Blocks <= 2.0.10 - Missing Authorization to Google API key update Exploitation status Not known exploited Fix Affected product G Getwid – Gutenberg Blocks Published 07/20/2024 Severity Medium CVE-2024-6491Getwid – Gutenberg Blocks <= 2.0.10 - Missing Authentication to MailChimp API key update Exploitation status Not known exploited Fix Affected product G Getwid – Gutenberg Blocks Published 07/20/2024 Severity Medium CVE-2024-4626JetWidgets For Elementor <= 1.0.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via layout_type and id Parameters Exploitation status Not known exploited Fix Affected product J JetWidgets For Elementor Published 06/20/2024 Severity Medium CVE-2024-5611Stratum – Elementor Widgets <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget Exploitation status Not known exploited Fix Affected product S Stratum Widgets for Elementor Published 06/15/2024 Severity Medium CVE-2024-4413Hotel Booking Lite <= 4.11.1 - Unauthenticated PHP Object Injection Exploitation status Not known exploited Fix Affected product M MotoPress Hotel Booking Published 05/10/2024 Severity Critical CVE-2024-3588Getwid – Gutenberg Blocks <= 2.0.7 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'Countdown' Exploitation status Not known exploited Fix Affected product G Getwid – Gutenberg Blocks Published 05/02/2024 Severity Medium CVE-2024-3342Timetable and Event Schedule by MotoPress <= 2.4.11 - Authenticated (Contributor+) SQL Injection Exploitation status Not known exploited Fix Affected product T Timetable and Event Schedule by MotoPress Published 04/27/2024 Severity Critical CVE-2024-31386Multiple WordPress themes affected by Cross-Site Request Forgery vulnerability Exploitation status Not known exploited Fix Affected product E Emmet Lite Published 04/10/2024 Severity Medium CVE-2024-2138JetWidgets For Elementor <= 1.0.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animated Box Widget Exploitation status Not known exploited Fix Affected product J JetWidgets For Elementor Published 04/09/2024 Severity Medium CVE-2024-2507JetWidgets For Elementor <= 1.0.16 - Authenticated(Contributor+) Stored Cross-Site Scripting via Widget Button URL Exploitation status Not known exploited Fix Affected product J JetWidgets For Elementor Published 04/09/2024 Severity Medium CVE-2024-1948Getwid – Gutenberg Blocks <= 2.0.5 - Authenticated(Contributor+) Stored Cross-Site Scripting via Block Content Exploitation status Not known exploited Fix Affected product G Getwid – Gutenberg Blocks Published 04/09/2024 Severity Medium CVE-2023-6963Getwid – Gutenberg Blocks <= 2.0.4 - Captcha Bypass Exploitation status Not known exploited Fix Affected product G Getwid – Gutenberg Blocks Published 02/05/2024 Severity Medium CVE-2023-6959Getwid – Gutenberg Blocks <= 2.0.4 - Missing Authorization to Recaptcha API Key Modification Exploitation status Not known exploited Fix Affected product G Getwid – Gutenberg Blocks Published 02/05/2024 Severity Medium CVE-2023-1895Getwid – Gutenberg Blocks <= 1.8.3 - Authenticated(Subscriber+) Server Side Request Forgery Exploitation status Not known exploited Fix Affected product G Getwid – Gutenberg Blocks Published 06/09/2023 Severity High CVE-2023-1910Getwid – Gutenberg Blocks <= 1.8.3 - Improper Authorization via get_remote_templates REST endpoint Exploitation status Not known exploited Fix Affected product G Getwid – Gutenberg Blocks Published 06/09/2023 Severity Medium CVE-2023-0086JetWidgets for Elementor <= 1.0.12 - Cross-Site Request Forgery to Settings Update Exploitation status Not known exploited Fix Affected product J JetWidgets For Elementor Published 01/05/2023 Severity Medium 
