| #1 | LightStart – Maintenance Mode, Coming Soon and Landing Page Builder | 35 | 42 | 306 | 400k+ | | | Request data is not unslashed |
| #2 | Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE | 35 | 132 | 42 | 300k+ | | | Missing direct file access protection |
| #3 | Redirection for Contact Form 7 | 27 | 34 | 374 | 200k+ | | | Non-prefixed global variable |
| #4 | Disable Admin Notices – Hide Dashboard Notifications | 24 | 464 | 195 | 100k+ | | | Output is not escaped |
| #5 | Menu Icons by Themeisle – Add Icons to Navigation Menus | 51 | 34 | 22 | 100k+ | | | Output is not escaped |
| #6 | Robin Image Optimizer – Unlimited Image Optimization, WebP & AVIF | 20 | 556 | 543 | 100k+ | | | Output is not escaped |
| #7 | Starter Sites & Templates by Neve | 35 | 26 | 88 | 100k+ | | | Non-prefixed hook name |
| #8 | Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More | 27 | 165 | 432 | 100k+ | | | Non-prefixed global variable |
| #9 | Woody Code Snippets – Insert PHP, CSS, JS, and Header/Footer Scripts | 35 | 64 | 91 | 60k+ | | | Output is not escaped |
| #10 | Titan Anti-spam & Security – Brute Force Protection, 2FA & Spam Filter | 31 | 57 | 196 | 50k+ | | | Nonce verification recommended |
| #11 | Auto Featured Image (Auto Post Thumbnail) | 79 | 5 | 30 | 50k+ | | | Non-prefixed hook name |
| #12 | Remove Category URL – Remove 'category' base from category permalinks | 78 | 6 | 8 | 50k+ | | | Missing direct file access protection |
| #13 | Cyrlitera – Transliteration of Links and File Names | 26 | 452 | 202 | 40k+ | | | Output is not escaped |
| #14 | RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator | 82 | | 292 | 40k+ | | | Non-prefixed global variable |
| #15 | Cyr to Lat Reloaded – Transliteration of Links and File Names | 64 | 14 | 36 | 30k+ | | | Direct Query |
| #16 | Media Library Organizer – Folders, File Manager & Media Categories | 72 | 20 | 130 | 20k+ | | | Non-prefixed global variable |
| #17 | Visualizer – Tables & Charts Manager with Built-in AI Generator | 29 | 343 | 323 | 20k+ | | | Output is not escaped |
| #18 | PPOM – Product Addons & Custom Fields for WooCommerce | 21 | 336 | 1,319 | 20k+ | | | Non-prefixed global variable |
| #19 | Social Slider Feed – Social Media Feed & Gallery Widgets | 24 | 927 | 706 | 10k+ | | | Non-prefixed global variable |
| #20 | Disable Updates – Updates Manager, Disable Automatic Updates, Disable All Updates | 24 | 521 | 134 | 10k+ | | | Output is not escaped |
| #21 | Disable Comments & Delete All Comments | 25 | 502 | 184 | 9k+ | | | Output is not escaped |
| #22 | Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions | 23 | 1,113 | 1,863 | 9k+ | | | Output is not escaped |
| #23 | Hyve Lite – AI Chatbot Trained on Your WordPress Content | 35 | 1 | 54 | 7k+ | | | Direct Query |
| #24 | MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO | 23 | 485 | 580 | 2k+ | | | Missing nonce verification |
| #25 | Neve Hooks | 98 | 4 | 0 | 400 | | | Missing direct file access protection |