| #151 | WP Recipe Maker | 24 | 494 | 942 | 50k+ | | | Non-prefixed global variable |
| #152 | WP-Stateless – Google Cloud Storage | 24 | 1,036 | 482 | 4k+ | | | Non Singular String Literal Domain |
| #153 | WP Travel – Ultimate Travel Booking System, Tour Management Engine | 24 | 227 | 1,941 | 4k+ | | | Non-prefixed hook name |
| #154 | WP Travel Engine – Tour Booking Plugin – Tour Operator Software | 24 | 2,030 | 5,704 | 20k+ | | | Non-prefixed global variable |
| #155 | WpStream – Live Streaming, Video on Demand, Pay Per View | 24 | 1,725 | 742 | 3k+ | | | Text Domain Mismatch |
| #156 | YayReviews – Advanced Customer Reviews for WooCommerce | 24 | 315 | 1,266 | 100 | | | Non-prefixed global variable |
| #157 | YITH WooCommerce Product Gallery & Image Zoom | 24 | 418 | 1,490 | 20k+ | | | Non-prefixed global variable |
| #158 | bbp style pack | 25 | 1,419 | 1,791 | 6k+ | | | Output is not escaped |
| #159 | Booking Calendar Contact Form | 25 | 371 | 884 | 500 | | | Input is not validated |
| #160 | HIPAA FORMS | 25 | 414 | 416 | 800 | | | Request data is not unslashed |
| #161 | Coinbase Business Gateway for WooCommerce | 25 | 569 | 1,317 | 800 | | | Non-prefixed global variable |
| #162 | DecaLog | 25 | 943 | 236 | 1k+ | | | Exception output is not escaped |
| #163 | Show Eventbrite Events – Event Feed for Eventbrite | 25 | 595 | 1,525 | 900 | | | Non-prefixed global variable |
| #164 | FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler | 25 | 325 | 526 | 8k+ | | | Non-prefixed global variable |
| #165 | Photo Gallery by FooGallery : Responsive Image Gallery, Masonry Gallery & Carousel | 25 | 607 | 1,799 | 100k+ | | | Non-prefixed global variable |
| #166 | AnWP Football Leagues | 25 | 3,598 | 1,955 | 800 | | | Text Domain Mismatch |
| #167 | GD Rating System | 25 | 1,511 | 1,043 | 1k+ | | | Output is not escaped |
| #168 | Simple Giveaways – Grow your business, email lists and traffic with contests | 25 | 956 | 2,384 | 400 | | | Non-prefixed global variable |
| #169 | IP Locator | 25 | 482 | 211 | 600 | | | Text Domain Mismatch |
| #170 | JoomSport – for Sports: Team & League, Football, Hockey & more | 25 | 523 | 1,747 | 1k+ | | | Direct Query |
| #171 | Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails | 25 | 4,996 | 1,724 | 5k+ | | | Text Domain Mismatch |
| #172 | Multibanco / MB Way / Payshop / Cofidis Pay (by LUSOPAY) for WooCommerce | 25 | 492 | 216 | 400 | | | Text Domain Mismatch |
| #173 | NOWPayments for WooCommerce – Crypto Payment Gateway | 25 | 534 | 1,306 | 4k+ | | | Non-prefixed global variable |
| #174 | Poll Maker by AYS – Versus Polls, Anonymous Polls, Image Polls | 25 | 489 | 1,414 | 7k+ | | | Non-prefixed global variable |
| #175 | Quttera ThreatSign – Web Malware Scanner for WordPress | 25 | 335 | 471 | 10k+ | | | Non-prefixed global variable |
| #176 | Seers AI | Cookie Consent Banner – GDPR & CCPA Compliant Consent Management Platform | 25 | 1,446 | 421 | 1k+ | | | Output is not escaped |
| #177 | Smart Manager – Advanced WooCommerce Bulk Editor & Inventory Manager (Spreadsheet) | 25 | 367 | 924 | 10k+ | | | SQL query is not prepared |
| #178 | Stylish Cost Calculator – Quote Generator, Lead Gen & Price Estimator | 25 | 648 | 1,021 | 1k+ | | | Output is not escaped |
| #179 | Ultimate Blocks – 25+ Blocks for Block Editor | 25 | 655 | 1,472 | 50k+ | | | Non-prefixed global variable |
| #180 | WP Airbnb Review Slider | 25 | 404 | 912 | 1k+ | | | Non-prefixed global variable |
| #181 | WP Crowdfunding | 25 | 193 | 1,630 | 2k+ | | | Non-prefixed global variable |
| #182 | WP Review Slider | 25 | 1,444 | 2,470 | 6k+ | | | Non-prefixed global variable |
| #183 | WP Go Maps – Google Map, OpenStreetMap, Leaflet Map | 25 | 4,996 | 1,020 | 300k+ | | | Unsafe printing function |
| #184 | WP Google Review Slider | 25 | 1,368 | 2,596 | 30k+ | | | Non-prefixed global variable |
| #185 | Smush – Image Optimization, Compression, Lazy Load, WebP & CDN | 25 | 244 | 568 | 1m+ | | | Non-prefixed hook name |
| #186 | WP TripAdvisor Review Slider | 25 | 1,063 | 2,582 | 8k+ | | | Non-prefixed global variable |
| #187 | WP Yelp Review Slider | 25 | 598 | 1,080 | 1k+ | | | Non-prefixed global variable |
| #188 | WPvivid — Backup, Migration & Staging | 25 | 903 | 1,461 | 900k+ | | | Non-prefixed namespace |
| #189 | AfterShip Tracking – All-In-One WooCommerce Order Tracking (Free plan available) | 26 | 286 | 291 | 7k+ | | | Text Domain Mismatch |
| #190 | AI Content Writing Assistant | 26 | 1,069 | 516 | 700 | | | Text Domain Mismatch |
| #191 | Accept Donations with PayPal & Stripe | 26 | 913 | 573 | 10k+ | | | Unsafe printing function |
| #192 | FG Drupal to WordPress | 26 | 275 | 100 | 700 | | | Unsafe printing function |
| #193 | FG PrestaShop to WooCommerce | 26 | 254 | 94 | 900 | | | Unsafe printing function |
| #194 | Live Composer – Free WordPress Website Builder | 26 | 1,211 | 427 | 10k+ | | | Output is not escaped |
| #195 | MakeStories (for Google Web Stories) | 26 | 117 | 416 | 600 | | | Nonce verification recommended |
| #196 | Organic Builder Widgets – Simple WordPress Page Builder | 26 | 1,034 | 125 | 3k+ | | | Output is not escaped |
| #197 | Packlink PRO for WooCommerce | 26 | 129 | 162 | 20k+ | | | Non-prefixed global variable |
| #198 | Crowdsignal Dashboard – Polls, Surveys & more | 26 | 481 | 491 | 200k+ | | | Unsafe printing function |
| #199 | VikWidgetsLoader – Collection of Widgets | 26 | 1,182 | 538 | 1k+ | | | Output is not escaped |
| #200 | Parcel Pro | 26 | 171 | 220 | 600 | | | Output is not escaped |