| #1 | Astra Customizer Reset | 97 | 7 | 1 | 30k+ | | | Text Domain Mismatch |
| #2 | Astra Hooks | 96 | 9 | 0 | 20k+ | | | Missing direct file access protection |
| #3 | Astra Bulk Edit | 91 | 4 | 3 | 30k+ | | | Missing direct file access protection |
| #4 | Power Coupons for WooCommerce | 90 | 6 | 91 | 30k+ | | | Non-prefixed global variable |
| #5 | SureCookie – Cookie Consent Banner, Cookie Scanner & Script Blocking | 88 | 44 | 49 | 20k+ | | | Missing Arg Domain |
| #6 | Astra Widgets | 86 | 10 | 15 | 200k+ | | | Missing direct file access protection |
| #7 | Variation Swatches for WooCommerce – Color, Image & Size Swatches | 86 | 2 | 17 | 200k+ | | | Request data is not unslashed |
| #8 | Modern Cart – WooCommerce Side Cart & Popup Cart | 86 | 8 | 95 | 60k+ | | | Non-prefixed global variable |
| #9 | Lightweight Sidebar Manager | 83 | 13 | 36 | 80k+ | | | Non-prefixed class |
| #10 | Fullwidth Templates for Any Theme & Page Builder | 81 | 12 | 23 | 20k+ | | | Non-prefixed constant |
| #11 | SureMail – SMTP and Email Logs Plugin with Amazon SES, Postmark, and Other Providers | 79 | 45 | 66 | 200k+ | | | Non-prefixed hook name |
| #12 | Import / Export Customizer Settings | 79 | 5 | 13 | 50k+ | | | Input is not sanitized |
| #13 | Custom Fonts – Host Your Fonts Locally | 77 | 14 | 20 | 400k+ | | | Request data is not unslashed |
| #14 | SureRank SEO – Meta Tags, Social Preview, XML Sitemap, Schema & Open Graph | 77 | 56 | 105 | 300k+ | | | Non-prefixed hook name |
| #15 | Custom Adobe Fonts (Typekit) | 75 | 11 | 33 | 60k+ | | | Non-prefixed global variable |
| #16 | SureFeedback Client Site | 59 | 47 | 24 | 5k+ | | | Text Domain Mismatch |
| #17 | Read Meter – Reading Time & Progress Bar | 49 | 39 | 50 | 10k+ | | | Request data is not unslashed |
| #18 | SureDonation – Donation Forms, Fundraising Campaigns & Donor Management | 45 | 44 | 76 | 2k+ | | | Missing Arg Domain |
| #19 | Schema – All In One Schema Rich Snippets | 44 | 609 | 186 | 30k+ | | | Text Domain Mismatch |
| #20 | SureContact – Newsletters, Email Marketing, Automation, Revenue Tracking & CRM | 36 | 310 | 132 | 10k+ | | | Text Domain Mismatch |
| #21 | Spectra Blocks – AI Website Builder for the Block Editor | 35 | 241 | 1,292 | 20k+ | | | Non-prefixed global variable |
| #22 | Ultimate Addons for Elementor – Widgets, Templates, WooCommerce & Header Footer Builder | 33 | 81 | 291 | 2m+ | | | Non-prefixed class |
| #23 | ZIP AI (Beta) – AI Website Builder, AI Agent & Assistant for WordPress | 31 | 218 | 330 | 600 | | | Non-prefixed namespace |
| #24 | SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz | 29 | 337 | 198 | 500k+ | | | Text Domain Mismatch |
| #25 | SureMembers – Membership & Content Restriction Plugin | 29 | 359 | 250 | 1k+ | | | Text Domain Mismatch |
| #26 | Cart Abandonment Recovery for WooCommerce – Recover Lost Sales with Automated Emails | 26 | 51 | 325 | 300k+ | | | Direct Query |
| #27 | Spectra Legacy – Gutenberg Blocks | 25 | 244 | 3,227 | 1m+ | | | Non-prefixed global variable |
| #28 | OttoKit: All-in-One Automation Platform | 25 | 1,593 | 1,829 | 90k+ | | | Missing direct file access protection |
| #29 | SureDash – Community, Courses & Member Dashboard | 25 | 420 | 811 | 1k+ | | | Non-prefixed global variable |
| #30 | Starter Templates – AI-Powered Templates for Elementor & Gutenberg | 24 | 126 | 402 | 1m+ | | | Non-prefixed hook name |
| #31 | Ultimate Addons for Beaver Builder – Lite | 24 | 2,751 | 486 | 20k+ | | | Text Domain Mismatch |
| #32 | CartFlows – Funnel Builder & Checkout Plugin for WooCommerce | 22 | 460 | 656 | 200k+ | | | Text Domain Mismatch |
