PluginCheck.Security.DirectDB.UnescapedDBParameter
Database parameter is not escaped
A value is passed into database-related code without escaping, preparation, or strict allowlisting.
Why It Shows Up
Plugin Check found a database parameter that appears to come from dynamic input without the usual `$wpdb->prepare()` protection.
Why It Matters
Database parameters often influence queries directly. Unsafe values can corrupt data access or create SQL injection risk.
How to Fix
- Use `$wpdb->prepare()` for values.
- Use explicit allowlists for table names, column names, order fields, and directions.
- Sanitize and validate request data before it reaches query construction.
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #901 | Ultimate Post Kit Addons for Elementor | 25 | 182 | 412 | 30k+ | Missing nonce verification | ||
| #902 | 3D viewer by Visody | 25 | 832 | 1,322 | 1k+ | Non-prefixed global variable | ||
| #903 | WC Disable Zoom / Lightbox features | 25 | 529 | 1,297 | 700 | Non-prefixed global variable | ||
| #904 | Product Customer List for WooCommerce | 25 | 610 | 1,334 | 9k+ | Non-prefixed global variable | ||
| #905 | weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot | 25 | 279 | 518 | 4k+ | Non-prefixed global variable | ||
| #906 | weForms – Easy Drag & Drop Contact Form Builder For WordPress | 25 | 916 | 450 | 10k+ | Output is not escaped | ||
| #907 | Secure Gateway for Authorize.net and WooCommerce by Pledged Plugins | 25 | 907 | 1,418 | 10k+ | Non-prefixed global variable | ||
| #908 | Bulk Edit Products for WooCommerce – WP Sheet Editor | 25 | 957 | 968 | 10k+ | Text Domain Mismatch | ||
| #909 | Digital Goods (Checkout Field Editor) for WooCommerce Checkout | 25 | 539 | 1,479 | 3k+ | Non-prefixed global variable | ||
| #910 | Dynamic Pricing and Discount Rules for WooCommerce | 25 | 531 | 1,569 | 600 | Non-prefixed global variable | ||
| #911 | Bulk Edit Coupons for WooCommerce – WP Sheet Editor | 25 | 1,022 | 982 | 500 | Text Domain Mismatch | ||
| #912 | Flat Rate Shipping Method for WooCommerce | 25 | 1,242 | 1,778 | 5k+ | Non-prefixed global variable | ||
| #913 | PDF Builder for WooCommerce. Create invoices,packing slips and more | 25 | 372 | 503 | 2k+ | Non-prefixed global variable | ||
| #914 | Product Table for WooCommerce | 25 | 183 | 896 | 5k+ | Non-prefixed global variable | ||
| #915 | Pay with Vipps and MobilePay for WooCommerce | 25 | 846 | 514 | 5k+ | Output is not escaped | ||
| #916 | HUSKY – Products Filter Professional for WooCommerce | 25 | 1,895 | 90k+ | Non-prefixed global variable | |||
| #917 | Wordfence Login Security | 25 | 248 | 418 | 70k+ | Output is not escaped | ||
| #918 | WP 2FA – Two-factor authentication for WordPress | 25 | 283 | 716 | 100k+ | Non-prefixed global variable | ||
| #919 | WP Airbnb Review Slider | 25 | 325 | 646 | 1k+ | Non-prefixed global variable | ||
| #920 | Super Page Cache – Cloudflare Cache, Page Speed & Core Web Vitals | 25 | 137 | 353 | 60k+ | Input is not sanitized | ||
| #921 | WP Coupons and Deals – WordPress Coupon Plugin | 25 | 914 | 1,460 | 1k+ | Non-prefixed global variable | ||
| #922 | WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards | 25 | 1,431 | 1,270 | 10k+ | Output is not escaped | ||
| #923 | WP-DownloadManager | 25 | 607 | 508 | 3k+ | Unsafe printing function | ||
| #924 | Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) | 25 | 2,652 | 2,091 | 10k+ | Text Domain Mismatch | ||
| #925 | WP Review Slider | 25 | 1,186 | 2,279 | 6k+ | Non-prefixed global variable | ||
| #926 | WP Go Maps – Google Map, OpenStreetMap, Leaflet Map | 25 | 4,996 | 1,008 | 300k+ | Unsafe printing function | ||
| #927 | WP Google Review Slider | 25 | 1,367 | 2,584 | 30k+ | Non-prefixed global variable | ||
| #928 | WP Encryption – No.1 HTTPS plugin & One Click Free SSL Cert, HTTPS Redirect, Security | 25 | 727 | 1,554 | 50k+ | Non-prefixed global variable | ||
| #929 | Nested Pages | 25 | 674 | 560 | 90k+ | Non-prefixed global variable | ||
| #930 | WP Photo Album Plus | 25 | 4 | 1,807 | 10k+ | Direct Query | ||
| #931 | WP-Polls | 25 | 618 | 639 | 40k+ | Unsafe printing function | ||
| #932 | WP Popups – WordPress Popup builder | 25 | 440 | 342 | 30k+ | Output is not escaped | ||
| #933 | Perfect Images: Regenerate Thumbnails, Image Sizes, WebP & AVIF | 25 | 158 | 118 | 60k+ | Non-prefixed global variable | ||
| #934 | Bulk Edit Posts and Products in Spreadsheet | 25 | 934 | 944 | 8k+ | Text Domain Mismatch | ||
| #935 | SlimStat Analytics | 25 | 1,177 | 870 | 70k+ | Exception output is not escaped | ||
| #936 | Smush – Image Optimization, Compression, Lazy Load, WebP & CDN | 25 | 244 | 568 | 1m+ | Non-prefixed hook name | ||
| #937 | WP Spell Check | 25 | 4,425 | 2k+ | Direct Query | |||
| #938 | WP Statistics – Simple, privacy-friendly Google Analytics alternative | 25 | 610 | 2,465 | 600k+ | Non-prefixed global variable | ||
| #939 | WP Super Cache | 25 | 800 | 989 | 1m+ | Output is not escaped | ||
| #940 | WP Time Slots Booking Form | 25 | 439 | 1,137 | 1k+ | Non-prefixed global variable | ||
| #941 | WP TripAdvisor Review Slider | 25 | 1,053 | 2,577 | 8k+ | Non-prefixed global variable | ||
| #942 | WP Yelp Review Slider | 25 | 429 | 645 | 1k+ | Non-prefixed global variable | ||
| #943 | WPCargo Track & Trace | 25 | 239 | 557 | 10k+ | Non-prefixed global variable | ||
| #944 | Team Members Showcase | 25 | 591 | 1,494 | 4k+ | Non-prefixed global variable | ||
| #945 | WPvivid Backup for MainWP | 25 | 818 | 1,794 | 10k+ | Missing nonce verification | ||
| #946 | WPvivid — Backup, Migration & Staging | 25 | 900 | 1,461 | 900k+ | Non-prefixed namespace | ||
| #947 | YeeMail — Email Template Builder & Customizer | 25 | 606 | 222 | 600 | wp function not compatible with requires wp | ||
| #948 | Video Gallery – YouTube Gallery, Playlist & Video Grid | 25 | 275 | 1,066 | 2k+ | Non-prefixed hook name | ||
| #949 | YT Player – Embed and Customize Video Players | 25 | 3,163 | 261 | 1k+ | Output is not escaped | ||
| #950 | ActiveCampaign for WooCommerce | 26 | 541 | 190 | 6k+ | Exception output is not escaped |
