PluginScore

PluginCheck.Security.DirectDB.UnescapedDBParameter

Database parameter is not escaped

A value is passed into database-related code without escaping, preparation, or strict allowlisting.

critical weight

Why It Shows Up

Plugin Check found a database parameter that appears to come from dynamic input without the usual `$wpdb->prepare()` protection.

Why It Matters

Database parameters often influence queries directly. Unsafe values can corrupt data access or create SQL injection risk.

How to Fix

  • Use `$wpdb->prepare()` for values.
  • Use explicit allowlists for table names, column names, order fields, and directions.
  • Sanitize and validate request data before it reaches query construction.

References

WordPress database accessWordPress validating, sanitizing, and escaping

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#2301Search and Replace707910k+Input is not sanitized
#2302Simple Login Captcha70201910k+date date
#2303Export Users With Meta7013132k+Direct Query
#2304BuddyPress Default Data71821400Interpolated SQL is not prepared
#2305Event SEO: Event Schema / Structured Data: Google Rich Snippet Schema for Event712449700Non-prefixed global variable
#2306Privyr CRM – Instant Lead Alerts for Contact Forms712254k+Non-prefixed function
#2307Discount Rules for WooCommerce7110454100k+Non-prefixed global variable
#2308WooCommerce Shipping714870k+Direct Query
#2309Cloudinary – Deliver Images and Videos at Scale726911345k+Text Domain Mismatch
#2310EU Order Withdrawal Button for WooCommerce72524064k+Non-prefixed hook name
#2311Media Library Organizer – Folders, File Manager & Media Categories722013020k+Non-prefixed global variable
#2312Shipping Rate By Cities72421700Direct Query
#2313Templ Optimizer726631k+Direct Query
#2314TinyPNG – JPEG, PNG & WebP image compression724073100k+Non-prefixed global variable
#2315EU Withdrawal Button for WooCommerce7327400Missing nonce verification
#2316EXMAGE – WordPress Image Links7314347k+Missing Arg Domain
#2317Permalinks Moved Permanently7377700Database parameter is not escaped
#2318TOCHAT.BE73271800Request data is not unslashed
#2319Bing URL Submissions Plugin74103840k+error log error log
#2320Edit Author Slug7458100k+Output is not escaped
#2321Fast Speed Index74912500Direct Query
#2322Product Layouts for WooCommerce745751k+Direct Query
#2323QODE Optimizer74124930k+Non-prefixed global variable
#2324Sublium Subscriptions – Subscriptions for WooCommerce – Recurring Payments, Subscription Plans & Installments743522400wp function not compatible with requires wp
#2325FlowForms – Conversational Form Builder7517400Nonce verification recommended
#2326FluentPlayer – Video Player With Forms & Lead Capture7510401k+Database parameter is not escaped
#2327WowOptin: Next-Gen Popup Maker – Create Stunning Popups and Optins for Lead Generation752601k+Database parameter is not escaped
#2328PopupAlly7540102k+Missing direct file access protection
#2329Addonify – WooCommerce Wishlist7630431k+Non-prefixed global variable
#2330Ajax Search Lite – Live Search & Filter7612626480k+Non-prefixed hook name
#2331CiviCRM Member Sync76870800Non-prefixed global variable
#2332FileBird Document Library7623135k+Text Domain Mismatch
#2333Rearrange Products for WooCommerce7612220k+Input is not sanitized
#2334StoreAgent – WooCommerce AI Chatbot & AI Content Tools76202500Non-prefixed global variable
#2335UTM Event Tracker and Analytics, UTM Grabber76219900Interpolated SQL is not prepared
#2336Action Network761917400error log error log
#2337Loyalty Points Rewards and Referral for WooCommerce – WPLoyalty762,2077603k+Text Domain Mismatch
#2338Better Search – Relevant search results for WordPress77181175k+Dynamic hook name
#2339Dual Currency Display77124900Direct Query
#2340Index WP Users For Speed7710351k+Non-prefixed global variable
#2341Internet Archive Wayback Machine Link Fixer772221k+Database parameter is not escaped
#2342Posts List7711157k+Non-prefixed hook name
#2343SureRank SEO – Smart Assistant with Meta Tags, Social Preview, XML Sitemap, and Schema775895300k+Non-prefixed hook name
#2344Claspo – Popups, Spin the Wheel & Email Capture78107161k+wp function not compatible with requires wp
#2345Recent Posts7872400Database parameter is not escaped
#2346SearchWP Live Ajax Search7882350k+Non-prefixed global variable
#2347WooCommerce Square78626680k+Non-prefixed hook name
#2348Real Category Management: Content Management in Category Folders794732k+Non-prefixed constant
#2349Retainful – WooCommerce Abandoned Cart, Newsletters, Email Marketing, Signup Forms and Automation7915261k+Non-prefixed hook name
#2350Rox Appointment Booking – Appointment Booking Scheduling Solution794151k+Database parameter is not escaped