| #51 | WP Compress – Instant Performance & Speed Optimization | 21 | 3,367 | 3,253 | 10k+ | | | Non Singular String Literal Domain |
| #52 | WP phpMyAdmin | 21 | 4,528 | 6,435 | 50k+ | | | Missing Arg Domain |
| #53 | Frontend Admin by DynamiApps | 22 | 5,922 | 3,208 | 10k+ | | | Text Domain Mismatch |
| #54 | Booking for Appointments and Events Calendar – Amelia | 22 | 1,489 | 480 | 90k+ | | | Exception output is not escaped |
| #55 | BuddyPress | 22 | 583 | 9,008 | 100k+ | | | Non-prefixed function |
| #56 | RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login | 22 | 3,654 | 5,061 | 8k+ | | | Non-prefixed global variable |
| #57 | Database Access with Adminer | 22 | 983 | 2,553 | 1k+ | | | Non-prefixed global variable |
| #58 | Directorist: AI-Powered Business Directory, Listings & Classified Ads | 22 | 548 | 2,172 | 20k+ | | | Non-prefixed global variable |
| #59 | Diverse Solutions IDX Real Estate Listings & MLS Search | 22 | 745 | 605 | 1k+ | | | Heredoc Output Not Escaped |
| #60 | Dynamic QR Code – generator | 22 | 238 | 208 | 6k+ | | | Missing direct file access protection |
| #61 | EleSpare – News, Magazine and Blog Addons for Elementor | 22 | 733 | 1,423 | 10k+ | | | Non-prefixed global variable |
| #62 | Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder | 22 | 409 | 236 | 700k+ | | | Text Domain Mismatch |
| #63 | Heureka | 22 | 557 | 254 | 400 | | | Exception output is not escaped |
| #64 | History Log by click5 | 22 | 675 | 1,290 | 400 | | | Direct Query |
| #65 | IMPress for IDX Broker | 22 | 1,085 | 636 | 6k+ | | | Text Domain Mismatch |
| #66 | The Innovative Form Builder – IvyForms | 22 | 713 | 250 | 400 | | | Exception output is not escaped |
| #67 | InfiniteWP Client | 22 | 2,286 | 1,812 | 200k+ | | | Exception output is not escaped |
| #68 | JCH Optimize | 22 | 1,143 | 136 | 4k+ | | | Output is not escaped |
| #69 | Jim Soft Swiss QR Invoice | 22 | 262 | 392 | 400 | | | Non-prefixed global variable |
| #70 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses | 22 | 2,346 | 3,341 | 70k+ | | | Non-prefixed global variable |
| #71 | Mail Baby SMTP | 22 | 385 | 699 | 600 | | | SQL query is not prepared |
| #72 | MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. | 22 | 2,625 | 2,458 | 10k+ | | | Output is not escaped |
| #73 | Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider | 22 | 207 | 323 | 500k+ | | | Non-prefixed global variable |
| #74 | Packeta | 22 | 801 | 333 | 8k+ | | | Exception output is not escaped |
| #75 | PagBank / PagSeguro Connect para WooCommerce | 22 | 504 | 757 | 4k+ | | | Non-prefixed global variable |
| #76 | PDF Builder for WPForms | 22 | 321 | 266 | 900 | | | SQL query is not prepared |
| #77 | PageSpeed Ninja – Cache, Minify, Defer CSS JavaScript, Critical CSS, Optimize Images, Convert WebP | 22 | 984 | 407 | 5k+ | | | Unsafe printing function |
| #78 | Restrict User Access – Ultimate Membership & Content Protection | 22 | 977 | 1,840 | 10k+ | | | Non-prefixed global variable |
| #79 | Social Sharing Plugin – Sassy Social Share | 22 | 1,689 | 233 | 100k+ | | | wp function not compatible with requires wp |
| #80 | Seraphinite Accelerator | 22 | 594 | 255 | 50k+ | | | Output is not escaped |
| #81 | Slim Jetpack | 22 | 2,586 | 1,947 | 2k+ | | | Text Domain Mismatch |
| #82 | NextScripts: Social Networks Auto-Poster | 22 | 2,408 | 1,133 | 30k+ | | | Output is not escaped |
| #83 | 10Web Booster – Website speed optimization, Cache & Page Speed optimizer | 22 | 513 | 601 | 80k+ | | | Non-prefixed global variable |
| #84 | Search & Replace Everything – Quick and Easy Way to Find and Replace Text, Links | 22 | 1,044 | 1,797 | 20k+ | | | Non-prefixed global variable |
| #85 | URL Shortify – Simple and Easy URL Shortener | 22 | 1,520 | 2,689 | 10k+ | | | Non-prefixed global variable |
| #86 | Welcart e-Commerce | 22 | 10,378 | 10,931 | 10k+ | | | Text Domain Mismatch |
| #87 | Wenprise WeChatPay Payment Gateway For WooCommerce | 22 | 443 | 178 | 400 | | | Exception output is not escaped |
| #88 | Fraud Prevention For WooCommerce and EDD | 22 | 572 | 1,394 | 5k+ | | | Non-prefixed global variable |
| #89 | WooCommerce | 22 | 1,359 | 6,172 | 7m+ | | | Non-prefixed global variable |
| #90 | ManageWP Worker | 22 | 507 | 565 | 1m+ | | | Non-prefixed class |
| #91 | Asset CleanUp: Page Speed Booster | 22 | 2,030 | 2,485 | 100k+ | | | Non-prefixed global variable |
| #92 | WP Umbrella: Update Backup Restore & Monitoring | 22 | 918 | 916 | 70k+ | | | Exception output is not escaped |
| #93 | WP Super Minify • Minify, Compress and Cache HTML, CSS & JavaScript | 22 | 164 | 257 | 9k+ | | | Non-prefixed constant |
| #94 | WPSSO Core – Complete Schema Markup and Meta Tags | 22 | 1,407 | 412 | 5k+ | | | Missing Translators Comment |
| #95 | YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports | 22 | 654 | 435 | 10k+ | | | Exception output is not escaped |
| #96 | ЮKassa для WooCommerce | 22 | 590 | 168 | 9k+ | | | Short PHP open tag found |
| #97 | B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More | 23 | 1,347 | 409 | 10k+ | | | Text Domain Mismatch |
| #98 | Kadence Security – Password, Two Factor Authentication, and Brute Force Protection | 23 | 1,053 | 967 | 700k+ | | | Missing Translators Comment |
| #99 | All In One Login — Login Page Security and Customization for WordPress with Google reCAPTCHA, Social Login, Temporary Login, 2FA, and more. | 23 | 750 | 1,359 | 60k+ | | | Non-prefixed global variable |
| #100 | CLUEVO LMS, E-Learning Platform | 23 | 1,843 | 1,176 | 400 | | | Text Domain Mismatch |