PluginScore

PluginCheck.Security.DirectDB.UnescapedDBParameter

Database parameter is not escaped

A value is passed into database-related code without escaping, preparation, or strict allowlisting.

critical weight

Why It Shows Up

Plugin Check found a database parameter that appears to come from dynamic input without the usual `$wpdb->prepare()` protection.

Why It Matters

Database parameters often influence queries directly. Unsafe values can corrupt data access or create SQL injection risk.

How to Fix

  • Use `$wpdb->prepare()` for values.
  • Use explicit allowlists for table names, column names, order fields, and directions.
  • Sanitize and validate request data before it reaches query construction.

References

WordPress database accessWordPress validating, sanitizing, and escaping

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#301ElementsReady Addons for Elementor232316663k+Non-prefixed global variable
#302Error Log Monitor236941,41420k+Non-prefixed global variable
#303Essential Real Estate235295,0608k+Non-prefixed global variable
#304EventON – Events Calendar232,5851,0216k+Text Domain Mismatch
#305Events Addon for Elementor237791,3397k+Non-prefixed global variable
#306Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI233951,34290k+Non-prefixed global variable
#307Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light23386999500Non-prefixed global variable
#308Export WordPress Pages to Static HTML & PDF — Static Site Export234903014k+Text Domain Mismatch
#309Ezoic2343251610k+Output is not escaped
#310Featured Images in RSS for Mailchimp & More237801,29920k+Non-prefixed global variable
#311Filr – Secure document library237751,317800Non-prefixed global variable
#312Finpose – Accounting for WooCommerce231,6491,307400Non-prefixed global variable
#313Image Photo Gallery Final Tiles Grid235781,50220k+Non-prefixed global variable
#314Five-Star Ratings Shortcode236041,317600Non-prefixed global variable
#315Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder234,7461,27930k+Non Singular String Literal Domain
#316Freshdesk (official)23194386900Non-prefixed function
#317Front End PM239782,2645k+Non-prefixed global variable
#318Tracking and Consent Manager – WP Full Picture231,2803,2233k+Non-prefixed global variable
#319Fuse Social Floating Sidebar231,8401,57310k+Non-prefixed global variable
#320FV Flowplayer Video Player231,3111,45420k+Output is not escaped
#321GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress233,6622,97110k+Output is not escaped
#322The GDPR Framework By Data443231,28751710k+Short PHP open tag found
#323Anti-Malware Security and Brute-Force Firewall23543965100k+Output is not escaped
#324Gmedia Photo Gallery233501,1217k+Non-prefixed global variable
#325Groundhogg — CRM, Newsletters, and Marketing Automation231369142k+Non-prefixed global variable
#326Interactive Content – H5P2356538040k+Non Singular String Literal Domain
#327Happy Addons for Elementor23573444400k+Output is not escaped
#328Houzez Property Feed231,4641,6151k+Text Domain Mismatch
#329Ibtana – Ecommerce Product Addons231,5471,7186k+Non Singular String Literal Domain
#330Iks Menu – WordPress Category Accordion Menu & FAQs236151,29310k+Non-prefixed global variable
#331Image Carousel For Divi235691,3091k+Non-prefixed global variable
#332Payment forms, Buy now buttons, and Invoicing System | GetPaid233871,2585k+Non-prefixed global variable
#333IP Geo Block233995899k+Output is not escaped
#334Jetpack – WP Security, Backup, Speed, & Growth232,8211,3033m+Text Domain Mismatch
#335Joli FAQ SEO – WordPress FAQ Plugin231,0831,526700Non-prefixed global variable
#336Justified Gallery235891,4178k+Non-prefixed global variable
#337Kenta Companion236571,4192k+Non-prefixed global variable
#338King Addons for Elementor – 80+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce, Mega Menu, Popup Builder231,8313,87810k+Non-prefixed global variable
#339KiviCare – Clinic & Patient Management System (EHR)232068502k+Direct Query
#340Masteriyo LMS – LMS Course Builder, Quizzes & Certificates231922,1235k+Non-prefixed global variable
#341License Manager for WooCommerce231298196k+Request data is not unslashed
#342Like Button Rating ♥ LikeBtn231,2316174k+Unsafe printing function
#343Link Whisper Free233,8825,30330k+Text Domain Mismatch
#344Locatoraid Store Locator233196451k+Non-prefixed global variable
#345Custom Login Page Customizer236871,40890k+Non-prefixed global variable
#346Login With Ajax – Fast Logins, 2FA, Redirects2362352010k+Output is not escaped
#347MailPoet – Newsletters, Email Marketing, and Automation23931719500k+Exception output is not escaped
#348Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits235251,54130k+Non-prefixed global variable
#349Master Slider – Responsive Touch Slider2380040860k+Output is not escaped
#350MasterStudy LMS WordPress Plugin – for Online Courses and Education231,4194,87510k+Non-prefixed global variable