PluginCheck.Security.DirectDB.UnescapedDBParameter
Database parameter is not escaped
A value is passed into database-related code without escaping, preparation, or strict allowlisting.
Why It Shows Up
Plugin Check found a database parameter that appears to come from dynamic input without the usual `$wpdb->prepare()` protection.
Why It Matters
Database parameters often influence queries directly. Unsafe values can corrupt data access or create SQL injection risk.
How to Fix
- Use `$wpdb->prepare()` for values.
- Use explicit allowlists for table names, column names, order fields, and directions.
- Sanitize and validate request data before it reaches query construction.
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #1901 | Unconfirmed | 38 | 20 | 79 | 1k+ | Nonce verification recommended | ||
| #1902 | VidShop – Shoppable Videos for WooCommerce | 38 | 54 | 153 | 1k+ | Database parameter is not escaped | ||
| #1903 | WholesaleX – B2B & Wholesale Plugin for WooCommerce with Wholesale Prices | 38 | 33 | 181 | 2k+ | Non-prefixed global variable | ||
| #1904 | WishSuite – Wishlist for WooCommerce | 38 | 76 | 133 | 1k+ | Output is not escaped | ||
| #1905 | Products Coming Soon for WooCommerce | 38 | 151 | 62 | 700 | Output is not escaped | ||
| #1906 | Wholesale for WooCommerce | 38 | 541 | 22 | 1k+ | Output is not escaped | ||
| #1907 | Connect WooCommerce Shop to ERP/CRM, Verifactu and EU/VAT Compliance | 38 | 23 | 104 | 1k+ | Direct Query | ||
| #1908 | WP 404 Auto Redirect to Similar Post | 38 | 166 | 48 | 30k+ | Text Domain Mismatch | ||
| #1909 | WP-DraftsForFriends | 38 | 141 | 71 | 1k+ | Output is not escaped | ||
| #1910 | Real-Time Post Statistics for WordPress | 38 | 63 | 68 | 1k+ | SQL query is not prepared | ||
| #1911 | Responsive Vertical Icon Menu | 38 | 188 | 85 | 700 | Output is not escaped | ||
| #1912 | ZeroBounce Email Verification & Validation | 38 | 299 | 162 | 900 | Text Domain Mismatch | ||
| #1913 | Zoho Campaigns | 38 | 3 | 129 | 3k+ | Non-prefixed global variable | ||
| #1914 | Ad Invalid Click Protector (AICP) | 39 | 78 | 57 | 10k+ | Text Domain Mismatch | ||
| #1915 | Add-on Gravity Forms – MailPoet 3 | 39 | 31 | 33 | 600 | Output is not escaped | ||
| #1916 | Additional Order Filters for WooCommerce | 39 | 79 | 255 | 2k+ | Nonce verification recommended | ||
| #1917 | Advanced Woo Labels – Product Labels & Badges for WooCommerce | 39 | 171 | 125 | 10k+ | Output is not escaped | ||
| #1918 | Affiliate Links – Link Cloaking and Management | 39 | 23 | 113 | 3k+ | Non-prefixed global variable | ||
| #1919 | Alt Magic: AI Image Alt Text Generator for WP & Image Rename | 39 | 61 | 112 | 1k+ | Direct Query | ||
| #1920 | Better Random Redirect | 39 | 88 | 40 | 700 | Text Domain Mismatch | ||
| #1921 | Better User Search | 39 | 24 | 44 | 700 | SQL query is not prepared | ||
| #1922 | Billplz for WooCommerce | 39 | 289 | 65 | 6k+ | Text Domain Mismatch | ||
| #1923 | Bogo | 39 | 30 | 139 | 10k+ | Request data is not unslashed | ||
| #1924 | Calculator Builder – Create an Online Calculator | 39 | 16 | 221 | 1k+ | Non-prefixed global variable | ||
| #1925 | CatFolders Document Gallery & PDF Library | 39 | 66 | 32 | 3k+ | Output is not escaped | ||
| #1926 | Constant Contact + WooCommerce | 39 | 27 | 91 | 1k+ | Nonce verification recommended | ||
| #1927 | Image CAPTCHA for Contact Form 7 and WPForms by HookAndHook (DSGVO/GDPR) | 39 | 28 | 45 | 80k+ | Missing nonce verification | ||
| #1928 | Content Visibility for Divi Builder | 39 | 184 | 59 | 2k+ | Non Singular String Literal Domain | ||
| #1929 | Custom Post Type Auto Menu | 39 | 54 | 33 | 500 | Text Domain Mismatch | ||
| #1930 | Da Reactions | 39 | 15 | 140 | 400 | Request data is not unslashed | ||
| #1931 | Datalogics Ecommerce Delivery – Datalogics | 39 | 13 | 115 | 500 | Nonce verification recommended | ||
| #1932 | DefendWP Firewall | 39 | 16 | 203 | 3k+ | Non-prefixed global variable | ||
| #1933 | Drip for Gravity Forms | 39 | 41 | 21 | 500 | Unsafe printing function | ||
| #1934 | Duplicate Killer – Prevent Duplicate Form Submissions | 39 | 57 | 103 | 1k+ | Non-prefixed global variable | ||
| #1935 | Caldera Forms styler for Elementor Page Builder | 39 | 173 | 12 | 700 | Text Domain Mismatch | ||
| #1936 | Email Marketing by EmailOctopus | 39 | 43 | 62 | 3k+ | Non-prefixed global variable | ||
| #1937 | First Order Discount Woocommerce | 39 | 55 | 30 | 1k+ | Output is not escaped | ||
| #1938 | Fix Duplicates | 39 | 76 | 73 | 800 | Output is not escaped | ||
| #1939 | Flamix: Bitrix24 and WooCommerce Orders integration | 39 | 81 | 31 | 500 | Output is not escaped | ||
| #1940 | Gallery Widget | 39 | 122 | 11 | 500 | Output is not escaped | ||
| #1941 | Maintenance Mode | 39 | 86 | 109 | 7k+ | Output is not escaped | ||
| #1942 | S2W – Import Shopify to WooCommerce | 39 | 8 | 132 | 3k+ | Request data is not unslashed | ||
| #1943 | Improved Save Button | 39 | 44 | 52 | 4k+ | Missing Translators Comment | ||
| #1944 | Insert Html Snippet | 39 | 159 | 205 | 20k+ | Output is not escaped | ||
| #1945 | JJ NextGen JQuery Carousel | 39 | 122 | 9 | 400 | Output is not escaped | ||
| #1946 | JJ NextGen JQuery Slider | 39 | 221 | 7 | 800 | Output is not escaped | ||
| #1947 | Mail Subscribe List | 39 | 17 | 94 | 3k+ | Input is not validated | ||
| #1948 | Markup by Attribute for WooCommerce | 39 | 46 | 102 | 2k+ | Direct Query | ||
| #1949 | Menubar | 39 | 171 | 46 | 1k+ | Output is not escaped | ||
| #1950 | payever – WooCommerce Gateway | 39 | 263 | 131 | 800 | Text Domain Mismatch |
