PluginScore

PluginCheck.Security.DirectDB.UnescapedDBParameter

Database parameter is not escaped

A value is passed into database-related code without escaping, preparation, or strict allowlisting.

critical weight

Why It Shows Up

Plugin Check found a database parameter that appears to come from dynamic input without the usual `$wpdb->prepare()` protection.

Why It Matters

Database parameters often influence queries directly. Unsafe values can corrupt data access or create SQL injection risk.

How to Fix

  • Use `$wpdb->prepare()` for values.
  • Use explicit allowlists for table names, column names, order fields, and directions.
  • Sanitize and validate request data before it reaches query construction.

References

WordPress database accessWordPress validating, sanitizing, and escaping

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#701WC Shop Sync – Square Payment Gateway and Product Synchronization for WooCommerce247611,612900Non-prefixed global variable
#702AI ChatBot for eCommerce – WoowBot24145528900Request data is not unslashed
#703WordLift – AI powered SEO – Schema24278949400Non-prefixed hook name
#704Yoast SEO – Advanced SEO with real-time guidance and built-in AI2415938610m+Non-prefixed global variable
#705WP Admin Audit241,0517811k+error log print r
#706WP-Appbox244183902k+Missing Arg Domain
#707Auto Affiliate Links243754073k+Output is not escaped
#708WP Contact Slider – Contact Form Slider Widget241,3552,5899k+Non-prefixed global variable
#709WP Discourse241031141k+Nonce verification recommended
#710WP Fastest Cache – WordPress Cache Plugin245417531m+Unsafe printing function
#711Iptanus File Upload245091,32510k+Non-prefixed function
#712WP Frontend Delete Account245371,3784k+Non-prefixed global variable
#713WP Helper Premium243,9081,5151k+Text Domain Mismatch
#714WP Hotel Booking241,2321,5337k+Non-prefixed global variable
#715WP Job Portal – AI-Powered Recruitment System for Company or Job Board website24781,1588k+Missing Version
#716WP-Members Membership Plugin2466938250k+Output is not escaped
#717WP Meta and Date Remover246651,31490k+Non-prefixed global variable
#718WP Notification Bell247361,591700Non-prefixed global variable
#719پارسی دیت – Parsi Date24106291100k+Non-prefixed hook name
#720WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars248611,57310k+Non-prefixed global variable
#721WP Recipe Maker2449494250k+Non-prefixed global variable
#722WP RSS Aggregator – RSS Import, Feed to Post, Autoblogging, AI Content241,77739440k+Text Domain Mismatch
#723WP School Calendar241,3611,721400Non-prefixed global variable
#724WSMS (formerly WP SMS) – SMS & MMS Notifications with OTP and 2FA for WooCommerce24911,7257k+Non-prefixed hook name
#725WP-Stateless – Google Cloud Storage241,0364824k+Non Singular String Literal Domain
#726Dynamic Team Manager – Team Member Showcase with grid, slider, table Elementor widget & shortcode249062,003900Non-prefixed global variable
#727WP Travel – Ultimate Travel Booking System, Tour Management Engine242271,9544k+Non-prefixed hook name
#728WP Travel Engine – Tour Booking Plugin – Tour Operator Software242,0125,68920k+Non-prefixed global variable
#729Export All Posts, Products, Orders & Users | WP Ultimate Exporter | WordPress CSV Export243631,1306k+Direct Query
#730Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress242,5812,109100k+Output is not escaped
#731WP User Manager – User Profile Builder & Membership2478753910k+Exception output is not escaped
#732WP Voting Contest Lite24259258400Text Domain Mismatch
#733WPAdverts – Classifieds Plugin241,3084964k+Output is not escaped
#734WPGSI: Spreadsheet Integration247841,5872k+Non-prefixed global variable
#735WPIDE – File Manager & Code Editor246101,38640k+Non-prefixed global variable
#736xili-language241,501523600Output is not escaped
#737YITH WooCommerce Gift Cards244361,53410k+Non-prefixed global variable
#738YITH WooCommerce Product Add-Ons244602,06920k+Non-prefixed global variable
#739YITH WooCommerce Wishlist244481,486400k+Non-prefixed global variable
#740Jetpack CRM – Clients, Leads, Invoices, Billing, Email Marketing, & Automation241,2113,15230k+Non-prefixed global variable
#7413DPrint Lite251751,029700Non-prefixed global variable
#742Adminify – White Label, Admin Menu Editor, Login Customizer255461,3707k+Non-prefixed global variable
#743AdRotate Banner Manager251,36384620k+Unsafe printing function
#744Advanced WordPress Reset – Debug, Recover & Reset WP2547546420k+Output is not escaped
#745AF Companion – Starter Sites, Speed Booster & Growth Suite for Professional Publishing256651,48610k+Non-prefixed global variable
#746Affiliates256891,4832k+Output is not escaped
#747FiboSearch – Ajax Search for WooCommerce25603302100k+Output is not escaped
#748AliExpress Dropshipping Plugin for WooCommerce Stores255507285k+Text Domain Mismatch
#749All 404 Redirect to Homepage25140301200k+date date
#750AIO Forms – Craft Complex Forms Easily25189418700Mixed line endings