WordPress.DB.DirectDatabaseQuery.DirectQuery
Direct Query
The plugin runs a direct database query instead of using a higher-level WordPress API or cache-aware pattern.
Why It Shows Up
Plugin Check found `$wpdb` access that queries the database directly, changes schema, or bypasses normal caching expectations.
Why It Matters
Direct queries can be correct, but they are easier to make unsafe, slower at scale, and harder for WordPress to cache or filter.
How to Fix
- Use WordPress APIs such as post, term, metadata, option, or user functions when they fit the task.
- If direct SQL is necessary, prepare dynamic values and add a clear caching strategy for repeated reads.
- Keep schema changes in activation or upgrade routines and make them idempotent.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #51 | MBE eShip | 20 | 527 | 740 | 1k+ | Non-prefixed global variable | ||
| #52 | Brevo – Email, SMS, Web Push, Chat, and more. | 20 | 460 | 646 | 100k+ | Request data is not unslashed | ||
| #53 | MAS Videos | 20 | 519 | 1,693 | 1k+ | Non-prefixed global variable | ||
| #54 | Microthemer Lite – Visual Editor to Customize CSS | 20 | 1,004 | 1,699 | 10k+ | Non-prefixed global variable | ||
| #55 | Nimble Page Builder | 20 | 1,591 | 1,684 | 30k+ | Missing Arg Domain | ||
| #56 | Shipping for Nova Poshta | 20 | 598 | 923 | 500 | Output is not escaped | ||
| #57 | پلاگین پرداخت دلخواه | 20 | 584 | 446 | 900 | Text Domain Mismatch | ||
| #58 | Pix por Piggly (para Woocommerce) | 20 | 547 | 195 | 4k+ | Exception output is not escaped | ||
| #59 | Powered Cache – Caching and Optimization for WordPress – Easily Improve PageSpeed & Web Vitals Score | 20 | 147 | 231 | 3k+ | Exception output is not escaped | ||
| #60 | Pronamic Pay | 20 | 266 | 1,078 | 2k+ | Non-prefixed global variable | ||
| #61 | Remove Add to Cart WooCommerce | 20 | 616 | 1,378 | 4k+ | Non-prefixed global variable | ||
| #62 | Robin Image Optimizer – Unlimited Image Optimization, WebP & AVIF | 20 | 556 | 543 | 100k+ | Output is not escaped | ||
| #63 | SpeakOut! Email Petitions | 20 | 850 | 994 | 2k+ | Missing nonce verification | ||
| #64 | Events Manager – OpenStreetMaps | 20 | 559 | 444 | 700 | Output is not escaped | ||
| #65 | Razorpay for WooCommerce | 20 | 975 | 859 | 100k+ | Non-prefixed function | ||
| #66 | Premium Packages – Sell Digital Products Securely | 20 | 2,017 | 2,183 | 2k+ | Non-prefixed global variable | ||
| #67 | School Management System – WPSchoolPress | 20 | 245 | 5,285 | 1k+ | Non-prefixed global variable | ||
| #68 | Store Locator WordPress | 21 | 2,494 | 1,628 | 10k+ | Text Domain Mismatch | ||
| #69 | Backup Migration | 21 | 981 | 1,093 | 80k+ | Non-prefixed global variable | ||
| #70 | Forumax – AI Powered Advanced Community Forum Plugin | 21 | 4,936 | 4,353 | 600 | Text Domain Mismatch | ||
| #71 | bbPress | 21 | 929 | 3,672 | 100k+ | Non-prefixed function | ||
| #72 | Kadence Security – Password, Two Factor Authentication, and Brute Force Protection | 21 | 1,060 | 957 | 700k+ | Missing Translators Comment | ||
| #73 | Pinpoint Booking System – Version 2 | 21 | 634 | 328 | 3k+ | Missing direct file access protection | ||
| #74 | Booking Ultra Pro Appointments Booking Calendar Plugin | 21 | 761 | 2,083 | 400 | Request data is not unslashed | ||
| #75 | Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots | 21 | 1,621 | 2,038 | 10k+ | Direct Query | ||
| #76 | Captcha Them All | 21 | 300 | 323 | 5k+ | Output is not escaped | ||
| #77 | CartFlows – Funnel Builder & Checkout Plugin for WooCommerce | 21 | 462 | 656 | 200k+ | Text Domain Mismatch | ||
| #78 | SMS Extension for Contact Form 7 | 21 | 720 | 1,387 | 400 | Non-prefixed global variable | ||
| #79 | Comet Cache | 21 | 857 | 245 | 20k+ | Output is not escaped | ||
| #80 | Cost Calculator Builder | 21 | 322 | 766 | 20k+ | Non-prefixed global variable | ||
| #81 | Daily Prayer Time | 21 | 947 | 1,780 | 1k+ | Non-prefixed global variable | ||
| #82 | DELUCKS SEO | 21 | 362 | 1,171 | 400 | Missing nonce verification | ||
| #83 | Free Downloads WooCommerce | 21 | 430 | 359 | 4k+ | Output is not escaped | ||
| #84 | Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More | 21 | 2,572 | 1,277 | 1m+ | Output is not escaped | ||
| #85 | Envo Extra | 21 | 878 | 600 | 20k+ | Text Domain Mismatch | ||
| #86 | eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams | 21 | 186 | 437 | 9k+ | Non-prefixed global variable | ||
| #87 | EventPrime – Events Calendar, Bookings and Tickets | 21 | 873 | 4,308 | 7k+ | Non-prefixed global variable | ||
| #88 | Feeds for YouTube (YouTube video, channel, and gallery plugin) | 21 | 558 | 978 | 100k+ | Output is not escaped | ||
| #89 | Filter Everything — WordPress & WooCommerce Filters | 21 | 643 | 933 | 50k+ | Non-prefixed global variable | ||
| #90 | Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More | 21 | 52 | 2,063 | 300k+ | Non-prefixed global variable | ||
| #91 | Campaign Monitor for WordPress | 21 | 386 | 461 | 2k+ | Non-prefixed global variable | ||
| #92 | Front End Users | 21 | 719 | 2,759 | 400 | Non-prefixed global variable | ||
| #93 | Frontend Dashboard | 21 | 384 | 945 | 500 | Non-prefixed function | ||
| #94 | Imagify Image Optimization: Optimize Images | Compress & Convert to WebP/AVIF | 21 | 428 | 862 | 1m+ | Non-prefixed global variable | ||
| #95 | Leyka | 21 | 257 | 3,446 | 2k+ | Request data is not unslashed | ||
| #96 | Mapster WP Maps | 21 | 3,440 | 2,894 | 3k+ | Text Domain Mismatch | ||
| #97 | Mergado Pack | 21 | 2,323 | 588 | 700 | Output is not escaped | ||
| #98 | Modular DS: Monitor, update, and backup multiple websites | 21 | 191 | 82 | 40k+ | Exception output is not escaped | ||
| #99 | Mooberry Book Manager | 21 | 1,040 | 399 | 1k+ | Text Domain Mismatch | ||
| #100 | MotoPress Hotel Booking | 21 | 3,067 | 1,037 | 10k+ | Text Domain Mismatch |
