WordPress.DB.DirectDatabaseQuery.DirectQuery

Direct Query

The plugin runs a direct database query instead of using a higher-level WordPress API or cache-aware pattern.

medium weight

Why It Shows Up

Plugin Check found `$wpdb` access that queries the database directly, changes schema, or bypasses normal caching expectations.

Why It Matters

Direct queries can be correct, but they are easier to make unsafe, slower at scale, and harder for WordPress to cache or filter.

How to Fix

  • Use WordPress APIs such as post, term, metadata, option, or user functions when they fit the task.
  • If direct SQL is necessary, prepare dynamic values and add a clear caching strategy for repeated reads.
  • Keep schema changes in activation or upgrade routines and make them idempotent.

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#551Business Essentials for Contact Form 7246744038k+Text Domain Mismatch
#552WOW Styler for CF7 – Visual Styler for Contact Form 7 Forms245341,5593k+Non-prefixed global variable
#553Kognetiks Chatbot for WordPress246511,486600Non-prefixed global variable
#554Church Admin241,5544,207900Direct Query
#555CleanTalk Anti-Spam. Spam Firewall & Bot protection248181,092200k+Missing nonce verification
#556Smart Online Order for Clover241,7461,2461k+Text Domain Mismatch
#557CM Pop-Up – Create engaging popups to capture attention and boost interaction244664088k+Output is not escaped
#558CMP – Coming Soon & Maintenance Plugin by NiteoThemes249491,336200k+Non-prefixed global variable
#559Complianz – GDPR/CCPA Cookie Consent244874031m+Missing Arg Domain
#560RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress248283,665500Request data is not unslashed
#561CF7 Apps – Honeypot, Database, Redirection, Webhook, and Addons for Contact Form 7241,0341,396300k+Non-prefixed global variable
#562Contact Form by Supsystic241,9136336k+Non Singular String Literal Domain
#563Contact Widgets For Elementor all the contact links you need in one place249081,188500Non-prefixed global variable
#564WPBot – ChatBot Conversational Forms241,2541,2262k+Text Domain Mismatch
#565CRM Perks Forms – WordPress Form Builder248195771k+Output is not escaped
#566Custom CSS247036571k+Output is not escaped
#567Custom Twitter Feeds – A Tweets Widget or X Feed Widget24446922100k+Output is not escaped
#568WP Customer Area243,30694110k+Text Domain Mismatch
#569Customer Reviews for WooCommerce242,2022,44580k+Output is not escaped
#570Defender Security – Malware Scanner, Login Security & Firewall2454759480k+Non-prefixed namespace
#571WP Comment Cleaner – Delete All Comments, Disable Comments, Bulk Delete & Remove Comments245871,43020k+Non-prefixed global variable
#572WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes)248452,6434k+Non-prefixed global variable
#573Democracy Poll243874367k+Short PHP open tag found
#574Deployer for Git245411,336500Non-prefixed global variable
#575DFX Automatic Role Changer for WooCommerce245971,308400Non-prefixed global variable
#576Digital License Manager24295670800Non-prefixed hook name
#577Double Opt-In for Contact Form 7 – Secure, GDPR-Compliant Email Verification242334411k+Non-prefixed hook name
#578Doubly – Cross Domain Copy Paste for WordPress242525510k+Output is not escaped
#579Drop Shadow Boxes246421,2904k+Non-prefixed global variable
#580DSGVO All in one for WP24751,63720k+Non-prefixed global variable
#581Dynamic Widgets2463181210k+Non-prefixed global variable
#582Easy Form Builder by WhiteStudio — Drag & Drop Form Builder241943811k+Nonce verification recommended
#583Easy Invoice – Invoice Generator, PDF Quotes & Payments241,3662,013500Non-prefixed global variable
#584Easy Modal245642997k+Unsafe printing function
#585E-cab Taxi Booking Manager for Woocommerce243561,4622k+Non-prefixed global variable
#586eCommerce Product Catalog Plugin for WordPress246213,1777k+Non-prefixed function
#587ELEX WooCommerce Request a Quote243982662k+Request data is not unslashed
#588Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress246521,49560k+Non-prefixed hook name
#589EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents247111,588100k+Output is not escaped
#590Enable Media Replace24212276600k+Output is not escaped
#591Conversios: Google Analytics (GA4), Google Ads, Conversion and Analytics Tracking for Multi-Channels241121,49710k+Non-prefixed global variable
#592Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns24120684200k+Non-prefixed global variable
#593Event Tickets and Registration243,4094,21790k+Non-prefixed global variable
#594Export WordPress Pages to Static HTML & PDF — Static Site Export245093044k+Text Domain Mismatch
#595Etsy Integration For WooCommerce241,2464,643900Non-prefixed global variable
#596F12 Profiler24282451500Direct Query
#597Fast Velocity Minify2428225640k+Unsafe printing function
#598Fattura2424312333400Output is not escaped
#599Featured Image from URL (FIFU)241,65441870k+Non Singular String Literal Domain
#600Featured Post with thumbnail24158122400Output is not escaped