PluginCheck.Security.DirectDB.UnescapedDBParameter
Database parameter is not escaped
A value is passed into database-related code without escaping, preparation, or strict allowlisting.
Why It Shows Up
Plugin Check found a database parameter that appears to come from dynamic input without the usual `$wpdb->prepare()` protection.
Why It Matters
Database parameters often influence queries directly. Unsafe values can corrupt data access or create SQL injection risk.
How to Fix
- Use `$wpdb->prepare()` for values.
- Use explicit allowlists for table names, column names, order fields, and directions.
- Sanitize and validate request data before it reaches query construction.
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #2151 | Userback | 47 | 13 | 20 | 2k+ | Output is not escaped | ||
| #2152 | FedaPay Gateway for WooCommerce | 47 | 24 | 11 | 700 | Output is not escaped | ||
| #2153 | WP Prefix Changer | 47 | 27 | 16 | 900 | Missing Arg Domain | ||
| #2154 | XML Sitemap & Google News | 47 | 270 | 224 | 100k+ | Non-prefixed global variable | ||
| #2155 | AffiliateWP – Store Credit | 48 | 47 | 21 | 400 | Output is not escaped | ||
| #2156 | Comment Notifier | 48 | 10 | 55 | 400 | Non-prefixed global variable | ||
| #2157 | Easy Share Solution For WordPress | 48 | 15 | 33 | 900 | Output is not escaped | ||
| #2158 | Jetpack Social | 48 | 829 | 254 | 30k+ | Text Domain Mismatch | ||
| #2159 | Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories | 48 | 63 | 273 | 100k+ | Non-prefixed global variable | ||
| #2160 | Seznam Webmaster | 48 | 47 | 8 | 700 | Output is not escaped | ||
| #2161 | Easy Updates Manager | 48 | 13 | 182 | 300k+ | Non-prefixed global variable | ||
| #2162 | WP Remote Users Sync | 48 | 355 | 117 | 6k+ | Text Domain Mismatch | ||
| #2163 | WS Action Scheduler Cleaner | 48 | 13 | 80 | 2k+ | error log error log | ||
| #2164 | CIO Custom Fields Importer | 49 | 23 | 8 | 400 | Output is not escaped | ||
| #2165 | Easy Property Listings | 49 | 60 | 66 | 5k+ | wp function not compatible with requires wp | ||
| #2166 | Import into Easy Property Listings | 49 | 335 | 24 | 1k+ | Text Domain Mismatch | ||
| #2167 | Anti-Spam Protection – No API Key, GDPR Friendly | 49 | 2 | 106 | 1k+ | Direct Query | ||
| #2168 | GamiPress – Multimedia Content | 49 | 11 | 25 | 500 | Nonce verification recommended | ||
| #2169 | Plugins Last Updated Column | 49 | 21 | 14 | 700 | Output is not escaped | ||
| #2170 | ReCrawler | 49 | 10 | 40 | 4k+ | Direct Query | ||
| #2171 | Simple MyISAM to InnoDB | 49 | 11 | 22 | 1k+ | Output is not escaped | ||
| #2172 | WP Sitemap Page | 49 | 43 | 14 | 200k+ | Missing Translators Comment | ||
| #2173 | WP Smart Import : Import any XML File to WordPress | 49 | 28 | 302 | 1k+ | Non-prefixed global variable | ||
| #2174 | User Activity Tracking and Log | 50 | 30 | 263 | 2k+ | Non-prefixed global variable | ||
| #2175 | WPML Multilingual for BuddyPress and BuddyBoss | 51 | 18 | 21 | 6k+ | SQL query is not prepared | ||
| #2176 | GamiPress – Reset User | 51 | 14 | 27 | 400 | Interpolated SQL is not prepared | ||
| #2177 | Lite Video Embed | 51 | 35 | 7 | 1k+ | Output is not escaped | ||
| #2178 | OnSale Page for WooCommerce | 51 | 30 | 44 | 2k+ | Text Domain Mismatch | ||
| #2179 | Popular Brand Icons – Simple Icons | 51 | 20 | 12 | 3k+ | Output is not escaped | ||
| #2180 | The Cache Purger | 51 | 16 | 16 | 1k+ | Non Singular String Literal Text | ||
| #2181 | Check Pincode For WooCommerce | 52 | 55 | 400 | Direct Query | |||
| #2182 | Firelight Lightbox | 52 | 78 | 97 | 200k+ | Non-prefixed global variable | ||
| #2183 | Fullscreen Galleria | 52 | 37 | 10 | 800 | Output is not escaped | ||
| #2184 | GSheetConnector for Gravity Forms – Send Gravity Forms Entries to Google Sheets in Real-Time | 52 | 26 | 27 | 1k+ | Exception output is not escaped | ||
| #2185 | SKU Generator for WooCommerce | 52 | 29 | 12 | 2k+ | Output is not escaped | ||
| #2186 | WPVibe – MCP Server for WordPress. Connect Claude, ChatGPT, Gemini & Cursor | 52 | 19 | 58 | 4k+ | Interpolated SQL is not prepared | ||
| #2187 | Wenprise Pinyin Slug | 52 | 30 | 34 | 4k+ | Text Domain Mismatch | ||
| #2188 | Automattic For Agencies Client | 53 | 249 | 184 | 20k+ | Text Domain Mismatch | ||
| #2189 | File Manager | 53 | 41 | 68 | 10k+ | Missing direct file access protection | ||
| #2190 | 워드프레스 결제 심플페이 – 우커머스 결제 플러그인 | 53 | 79 | 92 | 1k+ | Missing direct file access protection | ||
| #2191 | Royal WordPress Backup, Restore & Migration Plugin – Backup WordPress Sites Safely | 53 | 34 | 90 | 20k+ | Database parameter is not escaped | ||
| #2192 | Texty – SMS Notification for WordPress, WooCommerce, Dokan and more | 53 | 31 | 34 | 8k+ | Output is not escaped | ||
| #2193 | Ultimate Gift Cards for WooCommerce | 53 | 4 | 450 | 7k+ | Non-prefixed global variable | ||
| #2194 | aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder | 54 | 8 | 382 | 2k+ | Non-prefixed global variable | ||
| #2195 | Booking Calendar | 54 | 28 | 88 | 50k+ | Mixed line endings | ||
| #2196 | Customizable Post Listings | 54 | 42 | 13 | 700 | Deprecated parameter: the_author parameter 1 | ||
| #2197 | Cyr-To-Lat | 54 | 16 | 48 | 300k+ | Dynamic hook name | ||
| #2198 | Discount Rules for WooCommerce – Disco | Dynamic Pricing, Conditions, Bulk, Bundle, BOGO | 54 | 1 | 61 | 2k+ | Request data is not unslashed | ||
| #2199 | Expanding Archives | 54 | 37 | 9 | 3k+ | Output is not escaped | ||
| #2200 | Extended User Search In WP-Admin | 54 | 14 | 17 | 1k+ | SQL query is not prepared |
