PluginScore

WordPress.DB.DirectDatabaseQuery.DirectQuery

Direct Query

The plugin runs a direct database query instead of using a higher-level WordPress API or cache-aware pattern.

medium weight

Why It Shows Up

Plugin Check found `$wpdb` access that queries the database directly, changes schema, or bypasses normal caching expectations.

Why It Matters

Direct queries can be correct, but they are easier to make unsafe, slower at scale, and harder for WordPress to cache or filter.

How to Fix

  • Use WordPress APIs such as post, term, metadata, option, or user functions when they fit the task.
  • If direct SQL is necessary, prepare dynamic values and add a clear caching strategy for repeated reads.
  • Keep schema changes in activation or upgrade routines and make them idempotent.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#851Booking Calendar Contact Form25371884500Input is not validated
#852Booking Package251,7033,97710k+Missing nonce verification
#853Online Scheduling and Appointment Booking System – Bookly253,52887060k+Text Domain Mismatch
#854Breeze Cache25218800400k+Non-prefixed global variable
#855Broken Link Checker25727600500k+Output is not escaped
#856BuddyPress Docs252844217k+Nonce verification recommended
#857PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus253621,586100k+Non-prefixed global variable
#858SilentShield – Captcha & Anti-Spam for WordPress (CF7, WPForms, Elementor, WooCommerce)2523521410k+Database parameter is not escaped
#859GSheetConnector for CF7 – Connect Contact Form 7 to Google Sheets and Send Form Submissions in Real Time256141,43140k+Non-prefixed global variable
#860CheckoutWC Lite251,3998523k+Text Domain Mismatch
#861CheckView – Form & Checkout Testing25663371k+Direct Query
#862Admin Columns25613995100k+Non-prefixed namespace
#863Colissimo shipping methods for WooCommerce251,75555710k+Text Domain Mismatch
#864Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode25991,040700k+Non-prefixed global variable
#865Disable Comments & Delete All Comments255031859k+Output is not escaped
#866Coinbase Business Gateway for WooCommerce255691,317800Non-prefixed global variable
#867Conditional Payment Methods for WooCommerce255481,3981k+Non-prefixed global variable
#868Contact Form DB Divi255331,2993k+Non-prefixed global variable
#869Contact Form Email254098989k+Non-prefixed global variable
#870Coupon Creator256984121k+Output is not escaped
#871CP Contact Form with PayPal25466936800Unsafe printing function
#872Cryptocurrency Payment Gateway251,963589400Text Domain Mismatch
#873CSS & JavaScript Toolbox2515561710k+Non-prefixed class
#874Smash Balloon Social Post Feed – Simple Social Feeds for WordPress25554982200k+Output is not escaped
#875DecaLog259432361k+Exception output is not escaped
#876Demo Importer Plus255823910k+Non-prefixed hook name
#877Disable Admin Notices – Hide Dashboard Notifications25465195100k+Output is not escaped
#878Docket Cache – Object Cache Accelerator2533348120k+Output is not escaped
#879ELEX WooCommerce Dynamic Pricing and Discounts25478748800Text Domain Mismatch
#880WEB-Translation – eTranslation Multilingual252171,057400Non-prefixed function
#881Show Eventbrite Events – Event Feed for Eventbrite255951,525900Non-prefixed global variable
#882Event Genius – Event Management, Events Calendar, Registration, and RSVP251811,579500Non-prefixed global variable
#883Events Made Easy255066,3171k+Non-prefixed function
#884F4 Post Tree255361,332500Non-prefixed global variable
#885胖鼠采集(Fat Rat Collect)25630190900Missing Arg Domain
#886FlatPM – Ad Manager, AdSense and Custom Code253,01755710k+Text Domain Mismatch
#887FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler253234997k+Non-prefixed global variable
#888Lightbox & Modal Popup WordPress Plugin – FooBox256101,365100k+Non-prefixed global variable
#889Photo Gallery by FooGallery : Responsive Image Gallery, Masonry Gallery & Carousel258761,798100k+Non-prefixed global variable
#890AnWP Football Leagues253,5981,955900Text Domain Mismatch
#891WP Fast Total Search – The Power of Indexed Search252092911k+Non-prefixed global variable
#892FunnelKit – Funnel Builder for WooCommerce Checkout253,1642,62430k+Text Domain Mismatch
#893Photo Gallery by Ays – Responsive Image Gallery254668201k+Output is not escaped
#894GD Rating System251,5111,0431k+Output is not escaped
#895GD Security Headers254075211k+Output is not escaped
#896GeekyBot — AI Copilot, Chatbot, WooCommerce Lead Gen & Zero-Prompt Content25878636k+Non-prefixed global variable
#897Genesis Club Lite25513317900Output is not escaped
#898Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported)25501,0431k+Non-prefixed global variable
#899Simple Giveaways – Grow your business, email lists and traffic with contests259562,384400Non-prefixed global variable
#900WPBruiser {no- Captcha anti-Spam}2564625910k+Non Singular String Literal Domain