PluginCheck.Security.DirectDB.UnescapedDBParameter
Database parameter is not escaped
A value is passed into database-related code without escaping, preparation, or strict allowlisting.
Why It Shows Up
Plugin Check found a database parameter that appears to come from dynamic input without the usual `$wpdb->prepare()` protection.
Why It Matters
Database parameters often influence queries directly. Unsafe values can corrupt data access or create SQL injection risk.
How to Fix
- Use `$wpdb->prepare()` for values.
- Use explicit allowlists for table names, column names, order fields, and directions.
- Sanitize and validate request data before it reaches query construction.
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #1451 | EasyIndex | 34 | 74 | 135 | 1k+ | Missing nonce verification | ||
| #1452 | Einsatzverwaltung | 34 | 152 | 128 | 1k+ | Output is not escaped | ||
| #1453 | ePayco Plugin for WooCommerce | 34 | 155 | 136 | 3k+ | Text Domain Mismatch | ||
| #1454 | Event Post | 34 | 329 | 99 | 1k+ | Output is not escaped | ||
| #1455 | Meta for WooCommerce | 34 | 66 | 186 | 400k+ | Non-prefixed hook name | ||
| #1456 | Flash Toolkit | 34 | 158 | 242 | 10k+ | Non-prefixed global variable | ||
| #1457 | FluentAuth – The Ultimate Authorization & Security Plugin for WordPress | 34 | 44 | 229 | 10k+ | Nonce verification recommended | ||
| #1458 | Geliver Akıllı Kargo Pazaryeri | 34 | 49 | 247 | 400 | Non-prefixed global variable | ||
| #1459 | APG Google Video Sitemap Feed | 34 | 96 | 45 | 800 | Output is not escaped | ||
| #1460 | Gratisfaction- Loyalty, Rewards , Referral, Birthday and Giveaway Program | 34 | 131 | 352 | 600 | Missing nonce verification | ||
| #1461 | Signature Add-On for Gravity Forms | 34 | 161 | 48 | 1k+ | Text Domain Mismatch | ||
| #1462 | HollerBox — Fast & Effective Popups & Lead-Generation | 34 | 78 | 92 | 2k+ | Output is not escaped | ||
| #1463 | Image Cleanup | 34 | 52 | 94 | 1k+ | Nonce verification recommended | ||
| #1464 | Inavii Social Feed – Live Social Proof Gallery | 34 | 532 | 180 | 9k+ | Text Domain Mismatch | ||
| #1465 | JS Archive List | 34 | 99 | 31 | 3k+ | Output is not escaped | ||
| #1466 | Lenix Leads Collector | 34 | 414 | 242 | 10k+ | Text Domain Mismatch | ||
| #1467 | Login with Vipps and MobilePay | 34 | 263 | 174 | 900 | Output is not escaped | ||
| #1468 | Mass Ping Tool for SEO – WordPress ping list to get indexed faster on Google, Yandex, … | 34 | 77 | 96 | 400 | Output is not escaped | ||
| #1469 | Media Vault | 34 | 115 | 150 | 800 | Output is not escaped | ||
| #1470 | Montonio for WooCommerce | 34 | 44 | 257 | 10k+ | Non-prefixed global variable | ||
| #1471 | Multi Step Form | 34 | 277 | 139 | 9k+ | Output is not escaped | ||
| #1472 | Ni WooCommerce Custom Order Status | 34 | 256 | 139 | 2k+ | Text Domain Mismatch | ||
| #1473 | One User Avatar | User Profile Picture | 34 | 68 | 190 | 100k+ | Non-prefixed global variable | ||
| #1474 | Optima Express IDX | 34 | 71 | 237 | 10k+ | Non-prefixed class | ||
| #1475 | Child Theme Creator by Orbisius | 34 | 86 | 39 | 10k+ | Output is not escaped | ||
| #1476 | PW WooCommerce Bulk Edit | 34 | 219 | 149 | 20k+ | Unsafe printing function | ||
| #1477 | Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers | 34 | 261 | 863 | 20k+ | Non-prefixed global variable | ||
| #1478 | Responsive Menu – Create Mobile-Friendly Menu | 34 | 68 | 40 | 70k+ | Nonce verification recommended | ||
| #1479 | Event Timeline – Vertical Timeline | 34 | 26 | 684 | 1k+ | Non-prefixed global variable | ||
| #1480 | Route ‑ Shipping Protection | 34 | 64 | 150 | 500 | Missing nonce verification | ||
| #1481 | Search Meter | 34 | 191 | 94 | 20k+ | Output is not escaped | ||
| #1482 | Security Safe | 34 | 193 | 164 | 700 | Missing Translators Comment | ||
| #1483 | Seriously Simple Stats | 34 | 99 | 126 | 5k+ | Output is not escaped | ||
| #1484 | Student Result or Employee Database | 34 | 89 | 98 | 1k+ | Direct Query | ||
| #1485 | Social Integration for BlueSky | 34 | 98 | 147 | 700 | Non-prefixed global variable | ||
| #1486 | Software License Manager | 34 | 69 | 289 | 900 | Nonce verification recommended | ||
| #1487 | Subscribe to Download Lite – Email Before Download Plugin | 34 | 106 | 157 | 400 | Non-prefixed global variable | ||
| #1488 | SuperFrete | 34 | 84 | 242 | 1k+ | Request data is not unslashed | ||
| #1489 | TaxJar – Sales Tax Automation for WooCommerce | 34 | 236 | 170 | 5k+ | Text Domain Mismatch | ||
| #1490 | Testimonial Slider | 34 | 448 | 262 | 3k+ | Unsafe printing function | ||
| #1491 | Throws SPAM Away | 34 | 327 | 123 | 10k+ | Missing Arg Domain | ||
| #1492 | Tools for Twitter | 34 | 135 | 87 | 1k+ | Output is not escaped | ||
| #1493 | Visual Form Builder | 34 | 82 | 329 | 20k+ | Direct Query | ||
| #1494 | Abandoned Cart Reports For WooCommerce | 34 | 133 | 163 | 1k+ | Output is not escaped | ||
| #1495 | Donation Platform for WooCommerce: Fundraising & Donation Management | 34 | 331 | 448 | 7k+ | Non-prefixed global variable | ||
| #1496 | Simple Discount Rules for Woocommerce | 34 | 175 | 214 | 4k+ | Nonce verification recommended | ||
| #1497 | Integration for WooCommerce and Zoho CRM, Books, Invoice, Inventory, Bigin | 34 | 230 | 154 | 2k+ | Output is not escaped | ||
| #1498 | Digital Signature Add-on for WooCommerce | 34 | 165 | 76 | 1k+ | Text Domain Mismatch | ||
| #1499 | WP-Cron Status Checker | 34 | 277 | 111 | 5k+ | Text Domain Mismatch | ||
| #1500 | Wp Default Sender Email by IT Pixelz | 34 | 682 | 25 | 500 | Output is not escaped |
