Improper Input Validation vulnerabilities in WordPress plugins and themes
Improper input validation is the general case: a value is accepted and used without being checked against what the feature actually expects. The consequence depends entirely on where that value ends up, which is why advisories in this class range from harmless to critical.
What an attacker can do: submit values the application never expected, with effects that vary by feature CWE-20
- WPvivid - Improper Input Validation (CVE-2026-19722) MEDIUM
- MasterStudy LMS WordPress Plugin - Improper Input Validation (CVE-2026-81342) MEDIUM
- CVE-2026-77012 CRITICAL
- Total processing card payments for WooCommerce - Improper Input Validation (CVE-2026-16947) CRITICAL
- Allowing Unauthenticated Users Who Register Through The Ultimate Member - Improper Input Validation (CVE-2026-19423) HIGH
- Shared Files Pro - Improper Input Validation (CVE-2026-19084) HIGH
- Storegrowth - Improper Input Validation (CVE-2026-78137) HIGH
- Workeera - Improper Input Validation (CVE-2026-77016) CRITICAL
- Booking Package - Improper Input Validation (CVE-2026-16986) MEDIUM
- Wp Fastest Cache - Improper Input Validation (CVE-2026-74932) HIGH
- Advanced Product Fields For Woocommerce - Improper Input Validation (CVE-2026-2996) HIGH
- Tutor Lms - Improper Input Validation (CVE-2026-19093) MEDIUM
- Eventin - Improper Input Validation (CVE-2026-13176) LOW
- Ai Powered Woocommerce Multivendor Marketplace Solution - Improper Input Validation (CVE-2026-16577) LOW
- Tabapay Gateway - Improper Input Validation (CVE-2026-18031) CRITICAL
- Animation Addons For Elementor - Improper Input Validation (CVE-2026-17565) HIGH
- Every Site With The Simple Jwt Login - Improper Input Validation (CVE-2026-19714) CRITICAL
- Premium Packages - Improper Input Validation (CVE-2026-19711) MEDIUM
- Estatik Real Estate Plugin - Improper Input Validation (CVE-2026-18044) LOW
- Wallet System For Woocommerce - Improper Input Validation (CVE-2026-15045) MEDIUM
- Wp Photo Album Plus - Improper Input Validation (CVE-2026-18048) HIGH
- Stripe With Subscriptions For Woocommerce - Improper Input Validation (CVE-2026-17016) LOW
- Pinpoint Booking System - Improper Input Validation (CVE-2026-15229) MEDIUM
- Podcast Player - Improper Input Validation (CVE-2026-14860) MEDIUM
- Wp Data Access - Improper Input Validation (CVE-2026-18032) HIGH
- Appointment Hour Booking - Improper Input Validation (CVE-2026-16282) MEDIUM
- Subscriptions For Woocommerce - Improper Input Validation (CVE-2026-15211) MEDIUM
- Wp Events Manager - Improper Input Validation (CVE-2026-14205) CRITICAL
- Event Booking Manager for WooCommerce - Improper Input Validation (CVE-2026-16067) MEDIUM
- Integrate Phonepe With Woocommerce - Improper Input Validation (CVE-2026-10599) HIGH