PluginCheck.Security.DirectDB.UnescapedDBParameter
Database parameter is not escaped
A value is passed into database-related code without escaping, preparation, or strict allowlisting.
Why It Shows Up
Plugin Check found a database parameter that appears to come from dynamic input without the usual `$wpdb->prepare()` protection.
Why It Matters
Database parameters often influence queries directly. Unsafe values can corrupt data access or create SQL injection risk.
How to Fix
- Use `$wpdb->prepare()` for values.
- Use explicit allowlists for table names, column names, order fields, and directions.
- Sanitize and validate request data before it reaches query construction.
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #1751 | WP Custom Cursors | WordPress Cursor Plugin | 36 | 691 | 390 | 9k+ | Text Domain Mismatch | ||
| #1752 | WP-EMail | 36 | 340 | 95 | 1k+ | Unsafe printing function | ||
| #1753 | WP Header Images | 36 | 174 | 133 | 6k+ | Unsafe printing function | ||
| #1754 | WP Mail | 36 | 202 | 201 | 500 | Output is not escaped | ||
| #1755 | WP Sort Order | 36 | 134 | 211 | 6k+ | Direct Query | ||
| #1756 | WP Super Edit | 36 | 35 | 185 | 2k+ | Nonce verification recommended | ||
| #1757 | WP fail2ban Blocklist | 36 | 61 | 63 | 3k+ | SQL query is not prepared | ||
| #1758 | WPLMS H5P | 36 | 111 | 106 | 1k+ | Text Domain Mismatch | ||
| #1759 | Wppao Sitemap | 36 | 128 | 21 | 9k+ | Output is not escaped | ||
| #1760 | wpShopGermany IT-RECHT KANZLEI | 36 | 37 | 47 | 500 | Input is not sanitized | ||
| #1761 | Database Snapshots – WPvivid | 36 | 66 | 108 | 1k+ | Direct Query | ||
| #1762 | YayExtra – WooCommerce Extra Product Options | 36 | 11 | 472 | 1k+ | Non-prefixed global variable | ||
| #1763 | Zeno – AI-Powered Chatbot | 36 | 311 | 131 | 400 | Text Domain Mismatch | ||
| #1764 | Redirectioner | 37 | 234 | 410 | 1k+ | Output is not escaped | ||
| #1765 | Advanced Accordion Gutenberg Block – Create Beautiful FAQs, Content Accordions & Interactive Tabs | 37 | 39 | 36 | 10k+ | Missing direct file access protection | ||
| #1766 | AJAX Hits Counter + Popular Posts Widget | 37 | 247 | 44 | 1k+ | Output is not escaped | ||
| #1767 | Anything Popup | 37 | 164 | 185 | 2k+ | Non-prefixed global variable | ||
| #1768 | avalex – Automatisch sichere Rechtstexte | 37 | 25 | 85 | 1k+ | Direct Query | ||
| #1769 | Avatar Privacy | 37 | 82 | 36 | 1k+ | Missing direct file access protection | ||
| #1770 | Random Posts and Pages Widget | 37 | 322 | 15 | 1k+ | Output is not escaped | ||
| #1771 | Banhammer – Monitor Site Traffic, Block Bad Users and Bots | 37 | 104 | 174 | 1k+ | Output is not escaped | ||
| #1772 | Customize WordPress Emails and Alerts – Better Notifications for WP | 37 | 64 | 47 | 30k+ | Missing Arg Domain | ||
| #1773 | Contact Zalo Report SW | 37 | 44 | 39 | 900 | Missing Arg Domain | ||
| #1774 | ClickRank – Ai SEO Automation | 37 | 10 | 226 | 1k+ | Direct Query | ||
| #1775 | Lightweight Subscribe To Comments | 37 | 105 | 70 | 1k+ | Unsafe printing function | ||
| #1776 | CookieAdmin – Cookie Consent Banner | 37 | 43 | 86 | 400k+ | Nonce verification recommended | ||
| #1777 | CorvusPay WooCommerce Payment Gateway | 37 | 29 | 141 | 1k+ | Missing nonce verification | ||
| #1778 | Disclaimer Popup | 37 | 313 | 53 | 1k+ | Text Domain Mismatch | ||
| #1779 | Donation Block For PayPal | 37 | 23 | 106 | 600 | Input is not validated | ||
| #1780 | Pricing Table WordPress Plugin – Easy Pricing Tables | 37 | 332 | 161 | 10k+ | Output is not escaped | ||
| #1781 | Easy Testimonial Slider and Form | 37 | 14 | 144 | 700 | Request data is not unslashed | ||
| #1782 | Encyclopedia / Glossary / Wiki | 37 | 263 | 48 | 1k+ | Output is not escaped | ||
| #1783 | Excerpt Editor | 37 | 170 | 142 | 500 | Unsafe printing function | ||
| #1784 | Exploit Scanner | 37 | 25 | 130 | 8k+ | Non-prefixed global variable | ||
| #1785 | Get Custom Field Values | 37 | 40 | 44 | 1k+ | Output is not escaped | ||
| #1786 | 果果推送 | 37 | 31 | 56 | 1k+ | Nonce verification recommended | ||
| #1787 | GHL Gravity Bridge – Send Gravity Forms leads to GHL CRM | 37 | 59 | 269 | 600 | Direct Query | ||
| #1788 | Google for WooCommerce | 37 | 328 | 121 | 800k+ | Exception output is not escaped | ||
| #1789 | XML Sitemap Generator for Google | 37 | 43 | 79 | 1m+ | Input is not validated | ||
| #1790 | GoPay for WooCommerce | 37 | 66 | 103 | 1k+ | Non-prefixed global variable | ||
| #1791 | Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder | 37 | 83 | 113 | 20k+ | SQL query is not prepared | ||
| #1792 | Horizontal scrolling announcements | 37 | 215 | 140 | 8k+ | Output is not escaped | ||
| #1793 | Humans TXT | 37 | 159 | 86 | 400 | Output is not escaped | ||
| #1794 | JS Help Desk – AI-Powered Support & Ticketing System | 37 | 17 | 406 | 7k+ | Missing nonce verification | ||
| #1795 | Language Switcher | 37 | 81 | 105 | 1k+ | Missing Translators Comment | ||
| #1796 | LearnPress – Course Review | 37 | 67 | 43 | 20k+ | Output is not escaped | ||
| #1797 | Media Sweep – WordPress Media Cleaner | 37 | 56 | 137 | 1k+ | Interpolated SQL is not prepared | ||
| #1798 | Metorik – Reports & Email Automation for WooCommerce | 37 | 75 | 70 | 10k+ | Output is not escaped | ||
| #1799 | CrawlWP SEO – Instant Search Engine Indexing & SEO Performance Monitor | 37 | 47 | 90 | 40k+ | Dynamic hook name | ||
| #1800 | My Post Order | 37 | 100 | 114 | 400 | Output is not escaped |
