PluginScore

WordPress.DB.DirectDatabaseQuery.DirectQuery

Direct Query

The plugin runs a direct database query instead of using a higher-level WordPress API or cache-aware pattern.

medium weight

Why It Shows Up

Plugin Check found `$wpdb` access that queries the database directly, changes schema, or bypasses normal caching expectations.

Why It Matters

Direct queries can be correct, but they are easier to make unsafe, slower at scale, and harder for WordPress to cache or filter.

How to Fix

  • Use WordPress APIs such as post, term, metadata, option, or user functions when they fit the task.
  • If direct SQL is necessary, prepare dynamic values and add a clear caching strategy for repeated reads.
  • Keep schema changes in activation or upgrade routines and make them idempotent.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#901AForms — Form Builder for Price Calculator & Cost Estimation28564953k+Text Domain Mismatch
#902Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms286493579k+Text Domain Mismatch
#903Contact Form by BestWebSoft – Advanced WP Contact Form Builder for WordPress2846533830k+Text Domain Mismatch
#904Maspik – Ultimate Spam Protection2821286230k+Missing nonce verification
#905Deposits & Partial Payments for WooCommerce – Bayna285933361k+Output is not escaped
#906Dynamic User Directory284032561k+Output is not escaped
#907Discount Rules and Dynamic Pricing for WooCommerce2818233410k+Output is not escaped
#908easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution284058105k+Missing nonce verification
#909Embedder for Google Reviews285291,3236k+Non-prefixed global variable
#910Fluent Support – Helpdesk & Customer Support Ticket System285027110k+Direct Query
#911Reviews and Rating – Google Reviews2834321920k+Text Domain Mismatch
#912گیت‌لند | درگاه پرداخت هوشمند گیت‌لند283272352k+Output is not escaped
#913Geo Mashup287752321k+Text Domain Mismatch
#914HootKit284291,2958k+Non-prefixed global variable
#915Kadence Starter Templates — Predesigned Website Templates28312215300k+Missing Arg Domain
#916Kama Thumbnail2880479k+Output is not escaped
#917Maven Algolia28148896k+Non Singular String Literal Domain
#918Media Hygiene: Remove or Delete Unused Images and More!286543095k+Non Singular String Literal Domain
#919My Sticky Bar – Floating Notification Bar & Sticky Header (formerly myStickymenu)28161400100k+Non-prefixed global variable
#920Notification for Telegram28189934k+Output is not escaped
#921Store Hours for WooCommerce28525602k+Output is not escaped
#922Order Tracking – WordPress Status Tracking Plugin286197723k+Unsafe printing function
#923Perfect Brands for WooCommerce2811214340k+Non-prefixed constant
#924ووکامرس فارسی2815721590k+Output is not escaped
#925افزونه حمل و نقل ووکامرس | پست پیشتاز، تیپاکس و پیک موتوری2813119020k+Missing nonce verification
#926Podcast Importer SecondLine283561694k+Text Domain Mismatch
#927Redis Object Cache28151103400k+Exception output is not escaped
#928Responsive Lightbox & Gallery28139513100k+Non-prefixed hook name
#929Praison AI SEO286433061k+Text Domain Mismatch
#930Transliterator – Multilingual and Multi-script Text Conversion283053203k+Output is not escaped
#931Slider Pro285835274k+Unsafe printing function
#932Sparkle Demo Importer283071666k+Text Domain Mismatch
#933Tab – Accordion, FAQ281045421k+Non-prefixed global variable
#934Temporary Login Without Password28128131100k+wp function not compatible with requires wp
#935Themesflat Addons For Elementor2871422740k+Output is not escaped
#936Ultimate FAQ Accordion Plugin2838622730k+Unsafe printing function
#937Jetpack VaultPress287136210k+Missing nonce verification
#938WC Fields Factory281943697k+Nonce verification recommended
#93910WebSocial2858418510k+Unsafe printing function
#940Product Gallery Slider, Additional Variation Images for WooCommerce2855231620k+Output is not escaped
#941Dynamic Product Gallery for WooCommerce284143031k+Output is not escaped
#942Product Sort and Display for WooCommerce281992352k+Output is not escaped
#943WP ADA Compliance Check Basic287851773k+Text Domain Mismatch
#944WPS Bidouille2847221510k+Output is not escaped
#945WP Synchro – The Ultimate WordPress Migration Tool282432442k+Missing Translators Comment
#946YITH WooCommerce Product Bundles284041,4803k+Non-prefixed global variable
#947Accordion Slider293914442k+Unsafe printing function
#948Adminimize29296691200k+Non-prefixed global variable
#949AI Copilot – Content Generator291661611k+wp function not compatible with requires wp
#950AL Pack29138162k+Non-prefixed global variable