Improper Input Validation vulnerabilities in WordPress plugins and themes
Improper input validation is the general case: a value is accepted and used without being checked against what the feature actually expects. The consequence depends entirely on where that value ends up, which is why advisories in this class range from harmless to critical.
What an attacker can do: submit values the application never expected, with effects that vary by feature CWE-20
- Registration Form for WooCommerce - Improper Input Validation (CVE-2026-81431) HIGH
- Orbit Fox - Improper Input Validation (CVE-2026-85418) MEDIUM
- Sunshine Photo Cart - Improper Input Validation (CVE-2026-85037) MEDIUM
- SupportCandy - Improper Input Validation (CVE-2026-81022) MEDIUM
- Payment Plugins for PayPal WooCommerce - Improper Input Validation (CVE-2026-80340) MEDIUM
- Payment Plugins for Stripe WooCommerce - Improper Input Validation (CVE-2026-80339) MEDIUM
- JetFormBuilder - Improper Input Validation (CVE-2026-19862) MEDIUM
- Greenshift - Improper Input Validation (CVE-2026-83543) MEDIUM
- Accept Stripe Payments - Improper Input Validation (CVE-2026-81423) MEDIUM
- E-cab Taxi Booking Manager for Woocommerce - Improper Input Validation (CVE-2026-84045) MEDIUM
- WPvivid - Improper Input Validation (CVE-2026-82194) MEDIUM
- WPvivid - Improper Input Validation (CVE-2026-82193) MEDIUM
- RegistrationMagic - Improper Input Validation (CVE-2026-77794) MEDIUM
- RegistrationMagic - Improper Input Validation (CVE-2026-77793) MEDIUM
- GutenKit - Improper Input Validation (CVE-2026-19698) LOW
- Newspapers X - Improper Input Validation (CVE-2026-81779) CRITICAL
- WPvivid - Improper Input Validation (CVE-2026-19722) MEDIUM
- MasterStudy LMS - Improper Input Validation (CVE-2026-81342) MEDIUM
- CVE-2026-77012 CRITICAL
- Total processing card payments for WooCommerce - Improper Input Validation (CVE-2026-16947) CRITICAL
- Ultimate Member - Improper Input Validation (CVE-2026-19423) HIGH
- shared-files-pro - Improper Input Validation (CVE-2026-19084) HIGH
- StoreGrowth - Improper Input Validation (CVE-2026-78137) HIGH
- Workeera - Improper Input Validation (CVE-2026-77016) CRITICAL
- Booking Package - Improper Input Validation (CVE-2026-16986) MEDIUM
- WP Fastest Cache - Improper Input Validation (CVE-2026-74932) HIGH
- Advanced Product Fields For Woocommerce - Improper Input Validation (CVE-2026-2996) HIGH
- Tutor LMS - Improper Input Validation (CVE-2026-19093) MEDIUM
- Eventin - Improper Input Validation (CVE-2026-13176) LOW
- Dokan - Improper Input Validation (CVE-2026-16577) LOW