| #1 | RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator | 77 | 37 | 282 | 40k+ | | | Non-prefixed global variable |
| #2 | Neve Hooks | 98 | 4 | 0 | 400 | | | Missing direct file access protection |
| #3 | PPOM – Product Addons & Custom Fields for WooCommerce | 21 | 336 | 1,322 | 20k+ | | | Non-prefixed global variable |
| #4 | Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions | 23 | 1,123 | 1,860 | 9k+ | | | Output is not escaped |
| #5 | Starter Sites & Templates by Neve | 35 | 28 | 88 | 100k+ | | | Non-prefixed hook name |
| #6 | MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO | 23 | 488 | 580 | 2k+ | | | Missing nonce verification |
| #7 | Hyve Lite – AI Chatbot, ChatGPT-Powered Conversational Support | 35 | 1 | 40 | 7k+ | | | Direct Query |
| #8 | Disable Comments & Delete All Comments | 25 | 503 | 185 | 9k+ | | | Output is not escaped |
| #9 | Disable Updates – Updates Manager, Disable Automatic Updates, Disable All Updates | 24 | 522 | 135 | 10k+ | | | Output is not escaped |
| #10 | Social Slider Feed – Social Media Feed & Gallery Widgets | 24 | 929 | 707 | 20k+ | | | Non-prefixed global variable |
| #11 | Media Library Organizer – Folders, File Manager & Media Categories | 72 | 20 | 130 | 20k+ | | | Non-prefixed global variable |
| #12 | Visualizer – Tables & Charts Manager with Built-in AI Generator | 29 | 348 | 331 | 20k+ | | | Output is not escaped |
| #13 | Cyr to Lat Reloaded – Transliteration of Links and File Names | 65 | 13 | 36 | 30k+ | | | Direct Query |
| #14 | Cyrlitera – Transliteration of Links and File Names | 27 | 453 | 204 | 40k+ | | | Output is not escaped |
| #15 | Auto Featured Image (Auto Post Thumbnail) | 79 | 5 | 30 | 50k+ | | | Non-prefixed hook name |
| #16 | Remove Category URL – Remove 'category' base from category permalinks | 79 | 5 | 8 | 50k+ | | | Missing direct file access protection |
| #17 | Titan Anti-spam & Security – Brute Force Protection, 2FA & Spam Filter | 31 | 57 | 196 | 50k+ | | | Nonce verification recommended |
| #18 | Woody Code Snippets – Insert PHP, CSS, JS, and Header/Footer Scripts | 35 | 64 | 91 | 60k+ | | | Output is not escaped |
| #19 | Disable Admin Notices – Hide Dashboard Notifications | 25 | 465 | 195 | 100k+ | | | Output is not escaped |
| #20 | Robin Image Optimizer – Unlimited Image Optimization, WebP & AVIF | 20 | 557 | 541 | 100k+ | | | Output is not escaped |
| #21 | Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More | 27 | 165 | 430 | 100k+ | | | Non-prefixed global variable |
| #22 | Menu Icons by Themeisle – Add Icons to Navigation Menus | 51 | 34 | 22 | 100k+ | | | Output is not escaped |
| #23 | Redirection for Contact Form 7 | 27 | 34 | 374 | 200k+ | | | Non-prefixed global variable |
| #24 | Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE | 54 | 344 | 93 | 300k+ | | | Offloaded Content |
| #25 | LightStart – Maintenance Mode, Coming Soon and Landing Page Builder | 34 | 42 | 312 | 400k+ | | | Request data is not unslashed |
