PluginCheck.Security.DirectDB.UnescapedDBParameter

Database parameter is not escaped

A value is passed into database-related code without escaping, preparation, or strict allowlisting.

critical weight

Why It Shows Up

Plugin Check found a database parameter that appears to come from dynamic input without the usual `$wpdb->prepare()` protection.

Why It Matters

Database parameters often influence queries directly. Unsafe values can corrupt data access or create SQL injection risk.

How to Fix

  • Use `$wpdb->prepare()` for values.
  • Use explicit allowlists for table names, column names, order fields, and directions.
  • Sanitize and validate request data before it reaches query construction.

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#151PAYCOMET for WooCommerce221,2064232k+Text Domain Mismatch
#152Smart Popup by Supsystic223,17250310k+Non Singular String Literal Domain
#153Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App221,5812,326300k+Non-prefixed global variable
#154Prime Mover – Migrate WordPress Website & Backups221,3261,60010k+Non-prefixed global variable
#155Product Catalog Feed by PixelYourSite225813578k+Output is not escaped
#156Pronamic Pay222581,0773k+Non-prefixed global variable
#157PageSpeed Ninja – Cache, Minify, Defer CSS JavaScript, Critical CSS, Optimize Images, Convert WebP229844075k+Unsafe printing function
#158Restrict User Access – Ultimate Membership & Content Protection229771,84010k+Non-prefixed global variable
#159Salon Booking System – Free Version226506193k+Missing direct file access protection
#160Seraphinite Accelerator2259425550k+Output is not escaped
#161ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF221,044799300k+Non-prefixed global variable
#162Simple Job Board226341,35510k+Non-prefixed global variable
#163Slick Popup: Contact Form 7 Popup Plugin222,3223162k+Text Domain Mismatch
#164Slim Jetpack222,5861,9472k+Text Domain Mismatch
#165NextScripts: Social Networks Auto-Poster222,4081,13330k+Output is not escaped
#166SportsPress – Sports Club & League Manager224602,24210k+Non-prefixed global variable
#167SSL Zen — SSL Certificate Installer & HTTPS Redirects227791,57510k+Non-prefixed global variable
#168SVG Flags – Beautiful Scalable Flags For All Countries!227551,2512k+Non-prefixed global variable
#169Swift Performance Lite222,3461,3257k+Text Domain Mismatch
#170Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent222255198k+error log error log
#171Tag Groups is the Advanced Way to Display Your Taxonomy Terms225754653k+Unsafe printing function
#172ThemeHunk Customizer223,9695827k+Text Domain Mismatch
#173Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin225302,33440k+Direct Query
#174Search & Replace Everything – Quick and Easy Way to Find and Replace Text, Links221,0441,79720k+Non-prefixed global variable
#175URL Shortify – Simple and Easy URL Shortener221,5202,68910k+Non-prefixed global variable
#176Welcart e-Commerce2210,37710,89610k+Text Domain Mismatch
#177UserFeedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds22444243200k+Text Domain Mismatch
#178WCFM Marketplace – Multivendor Marketplace for WooCommerce221,9371,96910k+Non-prefixed global variable
#179WCFM Membership – WooCommerce Memberships for Multivendor Marketplace2255967510k+Non-prefixed global variable
#180Fraud Prevention For WooCommerce and EDD225721,3945k+Non-prefixed global variable
#181WooCommerce221,3556,1297m+Non-prefixed global variable
#182Advanced AJAX Product Filters222,6831,20550k+Text Domain Mismatch
#183CoDesigner – All in One Elementor WooCommerce Builder224,1317745k+Text Domain Mismatch
#184ManageWP Worker225075651m+Non-prefixed class
#185WP Affiliate Disclosure221,3581,5041k+Non-prefixed global variable
#186Asset CleanUp: Page Speed Booster222,0302,485100k+Non-prefixed global variable
#187WP Easy Pay – Payment and Donation form Builder for Square228931,8281k+Non-prefixed global variable
#188File Manager227405201m+Unsafe printing function
#189WP Fusion Lite – Marketing Automation and CRM Integration for WordPress222766835k+Nonce verification recommended
#190WP Umbrella: Update Backup Restore & Monitoring2291590570k+Exception output is not escaped
#191NotifSMS – SMS Notifications OTP & 2FA for WordPress & WooCommerce221,3531,4122k+Non-prefixed global variable
#192User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration222871,43220k+Non-prefixed global variable
#193WPBITS Addons For Elementor Page Builder229961,3992k+Non-prefixed global variable
#194WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell225,9962,7905k+Text Domain Mismatch
#195School Management System – WPSchoolPress223145,2201k+Non-prefixed global variable
#196WPSSO Core – Complete Schema Markup and Meta Tags221,4074125k+Missing Translators Comment
#197YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports2265443510k+Exception output is not escaped
#198YITH WooCommerce Ajax Search224081,65930k+Non-prefixed global variable
#199ЮKassa для WooCommerce225911689k+Short PHP open tag found
#200Recipe Cards For Your Food Blog from Zip Recipes221,1261,7311k+Non-prefixed global variable