PluginScore

PluginCheck.Security.DirectDB.UnescapedDBParameter

Database parameter is not escaped

A value is passed into database-related code without escaping, preparation, or strict allowlisting.

critical weight

Why It Shows Up

Plugin Check found a database parameter that appears to come from dynamic input without the usual `$wpdb->prepare()` protection.

Why It Matters

Database parameters often influence queries directly. Unsafe values can corrupt data access or create SQL injection risk.

How to Fix

  • Use `$wpdb->prepare()` for values.
  • Use explicit allowlists for table names, column names, order fields, and directions.
  • Sanitize and validate request data before it reaches query construction.

References

WordPress database accessWordPress validating, sanitizing, and escaping

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#201PAYCOMET for WooCommerce221,2064232k+Text Domain Mismatch
#202PDF Builder for WPForms22321266900SQL query is not prepared
#203Smart Popup by Supsystic223,17250310k+Non Singular String Literal Domain
#204Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App221,5812,326300k+Non-prefixed global variable
#205Prime Mover – Migrate WordPress Website & Backups221,3261,60010k+Non-prefixed global variable
#206Product Catalog Feed by PixelYourSite225813578k+Output is not escaped
#207Pronamic Pay222581,0772k+Non-prefixed global variable
#208PageSpeed Ninja – Cache, Minify, Defer CSS JavaScript, Critical CSS, Optimize Images, Convert WebP229844075k+Unsafe printing function
#209Request a Quote Form Plugin – Price Quote Request Management Made Easy222411,1091k+Non-prefixed hook name
#210Restrict User Access – Ultimate Membership & Content Protection229771,84010k+Non-prefixed global variable
#211Salon Booking System – Free Version226556202k+Missing direct file access protection
#212Sellsy22586490400Non Singular String Literal Domain
#213Seraphinite Accelerator2259425550k+Output is not escaped
#214ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF221,044799300k+Non-prefixed global variable
#215Simple Job Board226341,35510k+Non-prefixed global variable
#216Slick Popup: Contact Form 7 Popup Plugin222,3223162k+Text Domain Mismatch
#217Slim Jetpack222,5861,9472k+Text Domain Mismatch
#218NextScripts: Social Networks Auto-Poster222,4081,13330k+Output is not escaped
#219SportsPress – Sports Club & League Manager224602,24210k+Non-prefixed global variable
#220SSL Zen — SSL Certificate Installer & HTTPS Redirects227791,57510k+Non-prefixed global variable
#221SVG Flags – Beautiful Scalable Flags For All Countries!227551,2512k+Non-prefixed global variable
#222Swift Performance Lite222,3461,3257k+Text Domain Mismatch
#223Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent222255198k+error log error log
#224ThemeHunk Customizer223,9695826k+Text Domain Mismatch
#225Ultimate Carousel For Divi225901,566800Non-prefixed global variable
#226Ultimeter227511,3441k+Non-prefixed global variable
#227Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin225302,33440k+Direct Query
#228Unlimited Elements Blocks Library227081,822400Non-prefixed global variable
#229Search & Replace Everything – Quick and Easy Way to Find and Replace Text, Links221,0441,79720k+Non-prefixed global variable
#230URL Shortify – Simple and Easy URL Shortener221,5202,68910k+Non-prefixed global variable
#231Welcart e-Commerce2210,37710,89610k+Text Domain Mismatch
#232UserFeedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds22444243200k+Text Domain Mismatch
#233Walker Core221,3511,436800Non-prefixed global variable
#234WCFM – Frontend Manager for WooCommerce224,7545,05420k+Non-prefixed global variable
#235WCFM Marketplace – Multivendor Marketplace for WooCommerce221,9341,96610k+Non-prefixed global variable
#236WCFM Membership – WooCommerce Memberships for Multivendor Marketplace2255967510k+Non-prefixed global variable
#237Wenprise WeChatPay Payment Gateway For WooCommerce22443178400Exception output is not escaped
#238Fraud Prevention For WooCommerce and EDD225721,3945k+Non-prefixed global variable
#239WooCommerce221,3596,1717m+Non-prefixed global variable
#240Advanced AJAX Product Filters222,6831,20550k+Text Domain Mismatch
#241CoDesigner – All in One Elementor WooCommerce Builder224,1317745k+Text Domain Mismatch
#242ManageWP Worker225075651m+Non-prefixed class
#243WP Affiliate Disclosure221,3581,5041k+Non-prefixed global variable
#244Asset CleanUp: Page Speed Booster222,0302,485100k+Non-prefixed global variable
#245Master Accordion ( Former WP Awesome FAQ Plugin )221,7741,286700Non-prefixed global variable
#246WP Easy Pay – Payment and Donation form Builder for Square228931,8281k+Non-prefixed global variable
#247File Manager227405201m+Unsafe printing function
#248WP Fusion Lite – Marketing Automation and CRM Integration for WordPress222756835k+Nonce verification recommended
#249WP Umbrella: Update Backup Restore & Monitoring2291891670k+Exception output is not escaped
#250AidWP – Donation & Payment Forms (Stripe Powered)221,3171,675800Non-prefixed global variable