PluginScore

WordPress.DB.DirectDatabaseQuery.DirectQuery

Direct Query

The plugin runs a direct database query instead of using a higher-level WordPress API or cache-aware pattern.

medium weight

Why It Shows Up

Plugin Check found `$wpdb` access that queries the database directly, changes schema, or bypasses normal caching expectations.

Why It Matters

Direct queries can be correct, but they are easier to make unsafe, slower at scale, and harder for WordPress to cache or filter.

How to Fix

  • Use WordPress APIs such as post, term, metadata, option, or user functions when they fit the task.
  • If direct SQL is necessary, prepare dynamic values and add a clear caching strategy for repeated reads.
  • Keep schema changes in activation or upgrade routines and make them idempotent.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#1BulletProof Security05,0484,94920k+Output is not escaped
#2Live Shopping & Shoppable Videos For WooCommerce079174400Non-prefixed global variable
#3Plugin Check (PCP)012813210k+Exception output is not escaped
#4Themify Builder95,3042,1365k+Text Domain Mismatch
#5JetBackup – Backup, Restore & Migrate101,563149200k+Exception output is not escaped
#6Easy WP SMTP – WordPress SMTP and Email Logs: Gmail SMTP, Office 365, Outlook, Custom SMTP, and more1545166500k+Database parameter is not escaped
#7Visual Composer Website Builder168232040k+Non-prefixed global variable
#8MDTF – Meta Data and Taxonomies Filter161,5501,9561k+Non-prefixed global variable
#9AnyComment174454495k+Output is not escaped
#10RestroPress – Online Food Ordering System175243,1551k+Non-prefixed global variable
#11Dynamic Team Manager – Team Member Showcase with grid, slider, table Elementor widget & shortcode179222,014900Non-prefixed global variable
#12wpForo Forum174,0482,92220k+Unsafe printing function
#13WPtouch – Make your WordPress Website Mobile-Friendly171,46632550k+Text Domain Mismatch
#14Podlove Podcast Publisher182,3541,4333k+Output is not escaped
#15Property Hive181,9576,0273k+Missing nonce verification
#16Realtyna Organic IDX plugin + WPL Real Estate189303,6362k+Non-prefixed global variable
#17Shopping Cart & eCommerce Store185,37317,4663k+Non-prefixed global variable
#18WPPizza – A Restaurant Plugin184,6892,7031k+Text Domain Mismatch
#19Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons1910,340360100k+Text Domain Mismatch
#20Block Slider – Responsive Image Slider, Video Slider & Post Slider195551,2913k+Non-prefixed global variable
#21Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution191,218901100k+Exception output is not escaped
#22Go Fetch Jobs (for WP Job Manager)191,4101,741700Non-prefixed global variable
#23AI Infographic Maker191,383599600Output is not escaped
#24JetFormBuilder — Dynamic Blocks Form Builder192,1031,60480k+Text Domain Mismatch
#25Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps)193,2753,2289k+Output is not escaped
#26Matomo Analytics – Powerful, Privacy-First Insights for WordPress191,900877100k+Exception output is not escaped
#27Netgsm193343081k+Setting is missing a sanitization callback
#28Verified Reviews (Avis Vérifiés)196711,136700Non-prefixed global variable
#29Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)195363793m+Missing Translators Comment
#30Membership Plugin – Kadence Memberships195,0832,9829k+Text Domain Mismatch
#31Scrollsequence – Cinematic Scroll Image Animation Plugin198781,5284k+Non-prefixed global variable
#32SendPress Newsletters192,2931,4221k+Output is not escaped
#33SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments195331,14980k+Non-prefixed global variable
#34WP Email Template193443452k+Exception output is not escaped
#35WP Import Export Lite1973797940k+Non-prefixed global variable
#36WP Directory Kit191,5042,6382k+Non-prefixed global variable
#37WPJAM Basic193253464k+Output is not escaped
#38WPOSS阿里云对象存储19269315900Non-prefixed namespace
#39AweBooking – Hotel Booking System203095141k+Non-prefixed global variable
#40Brizy – Page Builder2058672670k+Output is not escaped
#41Broadstreet20434273700Output is not escaped
#42Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC)207362,112900Non-prefixed global variable
#43SysBasics Customize My Account for WooCommerce – Live My Account Customizer207439118k+Non-prefixed global variable
#44Download Monitor204231,36480k+Non-prefixed hook name
#45Event Espresso – Event Registration & Ticketing Sales2012,6982,135600Text Domain Mismatch
#46Event Organiser201,10454420k+Text Domain Mismatch
#47GiveWP – Donation Plugin and Fundraising Platform203,4103,554100k+Output is not escaped
#48GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership201,832720700Non Singular String Literal Domain
#49Leaky Paywall20322789600Nonce verification recommended
#50Link Library201,9421,39410k+Unsafe printing function