Plugins
49
Active Installs
18m+
Average Score
55
Findings
32k+
Top Scores
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #1 | Crowdsignal Forms | 100 | 0 | 200k+ | No open findings | |||
| #2 | Blaze Ads – Fully Integrated Ads Solution | 99 | 1 | 2 | 7k+ | Non-prefixed global variable | ||
| #3 | Layout Grid Block | 98 | 5 | 1 | 200k+ | Missing direct file access protection | ||
| #4 | Lazy Load | 98 | 4 | 0 | 10k+ | Missing direct file access protection | ||
| #5 | Event Block | 98 | 5 | 1 | 1k+ | Missing direct file access protection | ||
| #6 | Monster Widget | 98 | 3 | 4 | 700 | Non-prefixed hook name | ||
| #7 | Waves Block | 98 | 4 | 0 | 700 | Missing direct file access protection | ||
| #8 | Zone Manager (Zoninator) | 97 | 5 | 2 | 2k+ | Missing direct file access protection | ||
| #9 | Allow Numeric Slugs | 96 | 5 | 2 | 900 | Direct Query | ||
| #10 | Liveblog | 95 | 22 | 34 | 2k+ | Non-prefixed global variable | ||
| #11 | Query Loop Load More | 91 | 2 | 6 | 800 | Post Not In exclude | ||
| #12 | Post Meta Inspector | 83 | 6 | 1 | 2k+ | Unsafe printing function | ||
| #13 | Migrate to WordPress.com | 82 | 4 | 10 | 2k+ | Database parameter is not escaped | ||
| #14 | ActivityPub | 80 | 73 | 306 | 6k+ | Non-prefixed global variable | ||
| #15 | jQuery Lightbox For Native Galleries | 73 | 26 | 7 | 4k+ | Text Domain Mismatch | ||
| #16 | WordPress.com Editing Toolkit | 67 | 52 | 90 | 1k+ | Missing direct file access protection | ||
| #17 | Newspack Newsletters | 61 | 55 | 43 | 1k+ | Request data is not unslashed | ||
| #18 | Sensei LMS Certificates | 60 | 85 | 322 | 4k+ | Non-prefixed global variable | ||
| #19 | Co-Authors Plus | 59 | 2 | 76 | 20k+ | Input is not sanitized | ||
| #20 | Rewrite Rules Inspector | 58 | 7 | 59 | 10k+ | Nonce verification recommended | ||
| #21 | Clean Archives Reloaded | 55 | 25 | 6 | 500 | Unsafe printing function | ||
| #22 | Automattic For Agencies Client | 54 | 341 | 189 | 20k+ | Text Domain Mismatch | ||
| #23 | Gravatar Enhanced – Avatars, Profiles, and Privacy | 51 | 38 | 48 | 100k+ | Dynamic hook name | ||
| #24 | Batcache | 49 | 12 | 53 | 800 | Input is not sanitized | ||
| #25 | Jetpack Social | 48 | 829 | 254 | 30k+ | Text Domain Mismatch | ||
| #26 | Jetpack Search | 44 | 977 | 473 | 4k+ | Text Domain Mismatch | ||
| #27 | Share a Draft | 43 | 38 | 5 | 3k+ | Output is not escaped | ||
| #28 | Limit Login Attempts | 40 | 81 | 38 | 300k+ | Output is not escaped | ||
| #29 | Action Scheduler | 38 | 91 | 140 | 20k+ | Exception output is not escaped | ||
| #30 | WP-Cron Control | 37 | 54 | 22 | 1k+ | Output is not escaped | ||
| #31 | Akismet Anti-spam: Spam Protection | 35 | 31 | 101 | 5m+ | Non-prefixed global variable | ||
| #32 | Page Optimize | 35 | 70 | 41 | 200k+ | Non Singular String Literal Domain | ||
| #33 | IntenseDebate Comments | 35 | 203 | 114 | 500 | Output is not escaped | ||
| #34 | Super Cool Ad Inserter Plugin | 35 | 20 | 5 | 500 | Text Domain Mismatch | ||
| #35 | Custom JavaScript Editor | 35 | 8 | 23 | 400 | Missing Version | ||
| #36 | Edit Flow | 34 | 100 | 227 | 4k+ | Non-prefixed hook name | ||
| #37 | WooCommerce Legacy REST API | 31 | 324 | 177 | 400k+ | Missing Translators Comment | ||
| #38 | Jetpack VaultPress Backup | 30 | 719 | 274 | 20k+ | Text Domain Mismatch | ||
| #39 | Jetpack Protect | 28 | 796 | 266 | 100k+ | Text Domain Mismatch | ||
| #40 | WP Job Manager | 28 | 93 | 589 | 70k+ | Non-prefixed hook name | ||
| #41 | Jetpack VaultPress | 28 | 71 | 362 | 10k+ | Missing nonce verification | ||
| #42 | Jetpack Boost – Website Speed, Performance and Critical CSS | 27 | 711 | 297 | 200k+ | Text Domain Mismatch | ||
| #43 | Jetpack VideoPress | 27 | 983 | 300 | 7k+ | Text Domain Mismatch | ||
| #44 | Crowdsignal Dashboard – Polls, Surveys & more | 26 | 481 | 491 | 200k+ | Unsafe printing function | ||
| #45 | Sensei LMS – Online Courses, Quizzes, & Learning | 26 | 51 | 919 | 9k+ | Nonce verification recommended | ||
| #46 | WP Super Cache | 25 | 790 | 969 | 1m+ | Output is not escaped | ||
| #47 | Jetpack CRM – Clients, Leads, Invoices, Billing, Email Marketing, & Automation | 24 | 1,211 | 3,152 | 30k+ | Non-prefixed global variable | ||
| #48 | WooCommerce | 22 | 1,343 | 6,210 | 7m+ | Non-prefixed global variable | ||
| #49 | Jetpack – WP Security, Backup, Speed, & Growth | 22 | 3,422 | 1,481 | 3m+ | Text Domain Mismatch |