| #1 | Backup Migration | 21 | 981 | 1,093 | 80k+ | | | Non-prefixed global variable |
| #2 | Comet Cache | 21 | 857 | 245 | 20k+ | | | Output is not escaped |
| #3 | Cost Calculator Builder | 21 | 322 | 766 | 30k+ | | | Non-prefixed global variable |
| #4 | MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder | 21 | 1,133 | 3,011 | 2k+ | | | Non-prefixed global variable |
| #5 | Revive Social – Social Media Auto Post and Scheduling Automation Plugin | 21 | 255 | 425 | 20k+ | | | Non-prefixed hook name |
| #6 | Buckaroo Woocommerce Payments Plugin | 21 | 584 | 326 | 2k+ | | | Exception output is not escaped |
| #7 | WP phpMyAdmin | 21 | 4,528 | 6,435 | 50k+ | | | Missing Arg Domain |
| #8 | ANAC XML Bandi di Gara | 22 | 294 | 244 | 600 | | | Output is not escaped |
| #9 | Better WordPress Minify | 22 | 412 | 484 | 8k+ | | | Non Singular String Literal Domain |
| #10 | Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer | 22 | 2,858 | 1,270 | 50k+ | | | Text Domain Mismatch |
| #11 | Employee Spotlight – Team Member Showcase & Meet the Team Plugin | 22 | 247 | 689 | 400 | | | Non-prefixed hook name |
| #12 | Insert or Embed Articulate Content into WordPress | 22 | 659 | 1,437 | 2k+ | | | Non-prefixed global variable |
| #13 | MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. | 22 | 2,625 | 2,458 | 10k+ | | | Output is not escaped |
| #14 | Motors – Car Dealership & Classified Listings Plugin | 22 | 5,340 | 5,959 | 9k+ | | | Text Domain Mismatch |
| #15 | PagBank / PagSeguro Connect para WooCommerce | 22 | 504 | 757 | 4k+ | | | Non-prefixed global variable |
| #16 | NextScripts: Social Networks Auto-Poster | 22 | 2,408 | 1,133 | 30k+ | | | Output is not escaped |
| #17 | NotifSMS – SMS Notifications OTP & 2FA for WordPress & WooCommerce | 22 | 1,353 | 1,412 | 2k+ | | | Non-prefixed global variable |
| #18 | WP-WebAuthn | 22 | 957 | 396 | 2k+ | | | Exception output is not escaped |
| #19 | WPSSO Core – Complete Schema Markup and Meta Tags | 22 | 1,407 | 412 | 5k+ | | | Missing Translators Comment |
| #20 | YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports | 22 | 654 | 435 | 10k+ | | | Exception output is not escaped |
| #21 | Church Admin | 23 | 1,643 | 4,202 | 900 | | | Direct Query |
| #22 | EazyDocs – AI Powered Knowledge Base, Wiki, Documentation & FAQ Builder | 23 | 356 | 1,515 | 2k+ | | | Non-prefixed global variable |
| #23 | Flexmls® IDX Plugin | 23 | 1,268 | 957 | 1k+ | | | Output is not escaped |
| #24 | MasterStudy LMS WordPress Plugin – for Online Courses and Education | 23 | 1,419 | 4,875 | 10k+ | | | Non-prefixed global variable |
| #25 | MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar | 23 | 4,065 | 488 | 20k+ | | | Text Domain Mismatch |
| #26 | Next Active Directory Integration | 23 | 683 | 284 | 2k+ | | | Exception output is not escaped |
| #27 | Redirection | 23 | 523 | 457 | 100k+ | | | Non-prefixed global variable |
| #28 | Request a Quote – Quote Forms for Any WordPress Site | 23 | 240 | 1,099 | 1k+ | | | Non-prefixed hook name |
| #29 | Revive.so – Bulk Rewrite and Republish Blog Posts | 23 | 332 | 228 | 1k+ | | | Text Domain Mismatch |
| #30 | Schema | 23 | 1,173 | 245 | 40k+ | | | Text Domain Mismatch |
| #31 | W3 Total Cache | 23 | 307 | 678 | 900k+ | | | Non-prefixed global variable |
| #32 | Customer Support Ticket System & Helpdesk | 23 | 1,719 | 1,464 | 400 | | | Text Domain Mismatch |
| #33 | WP Ultimate CSV Importer – WordPress Import & Export for CSV, XML & Excel | 23 | 1,158 | 3,642 | 20k+ | | | Interpolated SQL is not prepared |
| #34 | Product Feed Manager For WooCommerce – Sell on 200+ Online Marketplaces | 24 | 2,248 | 3,338 | 10k+ | | | slow db query meta key |
| #35 | EmbedPress – PDF Embedder, Embed PDF viewer, YouTube Videos, 3D FlipBook, Social feeds & more | 24 | 669 | 1,550 | 100k+ | | | Output is not escaped |
| #36 | Simple Calendar – Google Calendar Plugin | 24 | 2,053 | 592 | 50k+ | | | Missing direct file access protection |
| #37 | Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System | 24 | 589 | 897 | 2k+ | | | Non-prefixed global variable |
| #38 | EU VAT Assistant for WooCommerce | 24 | 1,742 | 495 | 5k+ | | | Non Singular String Literal Domain |
| #39 | Appointment Hour Booking – Booking Calendar | 25 | 261 | 1,254 | 10k+ | | | Non-prefixed global variable |
| #40 | DecaLog | 25 | 943 | 236 | 1k+ | | | Exception output is not escaped |
| #41 | Site Kit by Google – Analytics, Search Console, AdSense, Speed | 25 | 1,304 | 242 | 5m+ | | | Missing direct file access protection |
| #42 | MaxButtons – Create buttons | 25 | 626 | 404 | 70k+ | | | Output is not escaped |
| #43 | Media Cloud Sync | 25 | 1,095 | 274 | 1k+ | | | Exception output is not escaped |
| #44 | Social Media Share Buttons & Social Sharing Icons | 25 | 2,433 | 1,383 | 100k+ | | | Unsafe printing function |
| #45 | Social Share Icons & Social Share Buttons | 25 | 2,365 | 1,357 | 10k+ | | | Output is not escaped |
| #46 | WP Time Slots Booking Form | 25 | 439 | 1,137 | 1k+ | | | Non-prefixed global variable |
| #47 | Video Gallery – YouTube Gallery, Playlist & Video Grid | 25 | 275 | 1,066 | 2k+ | | | Non-prefixed hook name |
| #48 | Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty | 26 | 113 | 671 | 400k+ | | | Non-prefixed global variable |
| #49 | FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) | 26 | 594 | 417 | 2k+ | | | Exception output is not escaped |
| #50 | User Submitted Posts – Enable Users to Submit Posts from the Front End | 26 | 699 | 396 | 10k+ | | | Text Domain Mismatch |