These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data-image-points' parameter in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2026-103912 is a Reflected DOM-Based Cross-Site Scripting vulnerability in JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress, affecting versions up to and including 3.6.6. The vulnerability is due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts. This vulnerability can be exploited on pages embedding a form that [truncated]
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'choice' Post Meta. This CVE was published on 2026-10-02T08:17:05.317Z and was last modified on 2026-10-03T16:16:49.020Z. The vulnerability allows unauthenticated attackers to inject arbitrary web scripts, which are stored verbatim into post meta and later rendered unescaped. Defenders sh [truncated]
The Restaurant Menu and Food Ordering plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'phone_number' parameter in all versions up to, and including, 2.4.14 due to insufficient input sanitization and output escaping. This vulnerability allows unauthenticated attackers to inject arbitrary web scripts, potentially leading to malicious code execution on affected sites. Defenders shou [truncated]
The JetFormBuilder plugin for WordPress has a Reflected Cross-Site Scripting vulnerability via the 'jfb_xss' URL query variable parameter in calculated fields up to version 3.6.5.3. This issue allows unauthenticated attackers to inject web scripts into pages if a user can be tricked into performing an action like clicking a link. The vulnerability requires a specific form configuration with both a URL Que [truncated]
CVE-2026-28140 is an unauthenticated broken access control vulnerability in JetFormBuilder plugin versions up to 3.6.4.1. This vulnerability has a CVSS score of 7.5 and is considered HIGH severity. The CVE record was published on 2026-08-06T15:16:52.707Z and has not been modified since then. Affected users should prioritize patching to prevent potential unauthorized access. The vulnerability allows attack [truncated]
A broken access control vulnerability exists in Restaurant Menu by MotoPress versions up to 2.4.11. This issue allows subscribers to access restricted functionality. The vulnerability has a CVSS score of 4.3 and is classified as MEDIUM severity.
CVE-2026-54196 is an Incorrect Privilege Assignment vulnerability in Jetmonsters JetFormBuilder that allows Privilege Escalation. The issue affects JetFormBuilder from n/a through 3.6.1. The CVSS score is 6.8, and the severity is MEDIUM. This vulnerability can have significant operational impacts, including potential privilege escalation, which requires verification of user privileges and access controls. [truncated]
CVE-2026-54195 is a HIGH severity vulnerability in JetFormBuilder versions <= 3.6.0.1. It allows unauthenticated Cross Site Scripting (XSS) attacks. The CVSS score is 7.1. The vulnerability was published on 2026-06-17T13:20:50.820Z and last modified on 2026-06-17T17:17:26.393Z. Users of affected versions should take immediate action to mitigate the risk.
The Timetable and Event Schedule by MotoPress plugin for WordPress is vulnerable to Insecure Direct Object Reference (IDOR) in all versions up to and including 2.4.16. The vulnerability exists in the `action_get_event_data` functionality, which fails to validate user-controlled keys. Authenticated attackers with contributor-level access or higher can enumerate timeslot IDs and retrieve complete WP_Post ob [truncated]
The MotoPress Hotel Booking plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.0.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite or delete the internal notes (_mphb_booking_internal_notes) of any booking by supplying an arbitrary booking ID. [truncated]