PluginScore

PluginCheck.Security.DirectDB.UnescapedDBParameter

Database parameter is not escaped

A value is passed into database-related code without escaping, preparation, or strict allowlisting.

critical weight

Why It Shows Up

Plugin Check found a database parameter that appears to come from dynamic input without the usual `$wpdb->prepare()` protection.

Why It Matters

Database parameters often influence queries directly. Unsafe values can corrupt data access or create SQL injection risk.

How to Fix

  • Use `$wpdb->prepare()` for values.
  • Use explicit allowlists for table names, column names, order fields, and directions.
  • Sanitize and validate request data before it reaches query construction.

References

WordPress database accessWordPress validating, sanitizing, and escaping

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#1001Ultimate Reviews26515345500Output is not escaped
#1002UpdraftCentral Dashboard262671806k+Missing Translators Comment
#1003Visitors Online by BestWebSoft265122691k+Text Domain Mismatch
#1004Cart Abandonment Recovery for WooCommerce – Recover Lost Sales with Automated Emails2651325300k+Direct Query
#1005Premmerce SEO for WooCommerce265501,2851k+Non-prefixed global variable
#1006Set Price Note (Units, Offers, Editions) for WooCommerce265961,307800Non-prefixed global variable
#1007Shipping Method Display Style for WooCommerce265291,3082k+Non-prefixed global variable
#1008XL NMI Gateway for WooCommerce266954361k+Text Domain Mismatch
#1009Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered)262,6522,09310k+Text Domain Mismatch
#1010WP Flashy Marketing Automation264321862k+Text Domain Mismatch
#1011WPCOM Member264326381k+Non Singular String Literal Domain
#1012WPFrank Companion262,3568651k+Text Domain Mismatch
#1013Divi Torque Lite – Divi Modules for the Divi Builder & Theme2714927350k+Non-prefixed global variable
#1014Amazon Product in a Post Plugin27362416800Output is not escaped
#1015Arconix FAQ275522016k+Text Domain Mismatch
#1016Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms277203675k+Text Domain Mismatch
#1017WP Zoho for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms – CRM, Bigin276923813k+Text Domain Mismatch
#1018Divi Collage275161,183700Non-prefixed global variable
#1019Comment Link Remove and Other Comment Tools276911327k+Text Domain Mismatch
#1020Contact Form Generator : Creative form builder for WordPress271,0761,510800Output is not escaped
#1021Duplicate Post27447274300k+Unsafe printing function
#1022Polls CP27399500400Output is not escaped
#1023Cyrlitera – Transliteration of Links and File Names2745320440k+Output is not escaped
#1024Echo Knowledge Base – Documentation, FAQs, Chat & Smart Search2728975110k+Output is not escaped
#1025EZ SQL Reports Shortcode Widget and DB Backup27165158500Output is not escaped
#1026CM Tooltip Glossary276111887k+Output is not escaped
#1027Events Calendar for GeoDirectory271,2624622k+Text Domain Mismatch
#1028Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin271221353k+Non-prefixed global variable
#1029Extra Product Options for WooCommerce275481,342600Non-prefixed global variable
#1030Foxtool All-in-One: Contact chat button, Custom login, Media optimize images271,6293607k+Unsafe printing function
#1031Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin272134952k+Non-prefixed global variable
#1032StylePress for Elementor27767283600Text Domain Mismatch
#1033Gravity Forms Directory27202457600Non-prefixed global variable
#1034Gravity Forms + Stripe27368210600Output is not escaped
#1035GSpeech TTS – WordPress Text To Speech Plugin278423333k+Output is not escaped
#1036HM Multiple Roles275371,2871k+Non-prefixed global variable
#1037ImageRecycle pdf & image compression273292041k+Text Domain Mismatch
#1038Import Eventbrite Events271565753k+Non-prefixed global variable
#1039iQ Block Country2716424520k+Request data is not unslashed
#1040My Private Site – Make Your Whole Site Private, Force Login & Block Registration Spam2771332110k+Text Domain Mismatch
#1041Liza Widget For Spotify and Elementor276091,2871k+Non-prefixed global variable
#1042Login Security Solution272161544k+Output is not escaped
#1043Magical Shop Builder – WooCommerce Template Builder for Elementor | Shop, Cart, Checkout & Product Page Builder27764593k+Non-prefixed namespace
#1044MakeCommerce for WooCommerce278264523k+Text Domain Mismatch
#1045MaxGalleria272785672k+Non-prefixed global variable
#1046Memberful – Membership Plugin273513361k+Text Domain Mismatch
#1047MLSImport – Download and synchronize real estate data from various MLS (Multiple Listing Services)271545515k+Non-prefixed global variable
#1048Nextend Social Login and Register271,668243200k+Output is not escaped
#1049Online Lesson Booking27978281500Non Singular String Literal Domain
#1050Pie Register – User Registration, Profiles & Content Restriction271,7791k+Non-prefixed global variable