PluginScore

WordPress.DB.DirectDatabaseQuery.DirectQuery

Direct Query

The plugin runs a direct database query instead of using a higher-level WordPress API or cache-aware pattern.

medium weight

Why It Shows Up

Plugin Check found `$wpdb` access that queries the database directly, changes schema, or bypasses normal caching expectations.

Why It Matters

Direct queries can be correct, but they are easier to make unsafe, slower at scale, and harder for WordPress to cache or filter.

How to Fix

  • Use WordPress APIs such as post, term, metadata, option, or user functions when they fit the task.
  • If direct SQL is necessary, prepare dynamic values and add a clear caching strategy for repeated reads.
  • Keep schema changes in activation or upgrade routines and make them idempotent.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#1051Backup, Restore and Migrate your sites with XCloner2523886410k+Input is not sanitized
#1052YeeMail — Email Template Builder & Customizer25606222600wp function not compatible with requires wp
#1053Video Gallery – YouTube Gallery, Playlist & Video Grid252751,0702k+Non-prefixed hook name
#1054YT Player – Embed and Customize Video Players253,1632611k+Output is not escaped
#1055ActiveCampaign for WooCommerce265411906k+Exception output is not escaped
#1056AfterShip Tracking – All-In-One WooCommerce Order Tracking (Free plan available)262862918k+Text Domain Mismatch
#1057AI Content Writing Assistant261,069516700Text Domain Mismatch
#1058Attesa Extra263161511k+Output is not escaped
#1059Bangladeshi Payments Mobile – QR Code & Transaction Reports265351,2801k+Non-prefixed global variable
#1060Blog Floating Button267052409k+Output is not escaped
#1061Booking Manager – Sync WP Booking Calendar – Import Events, Export Bookings to ICS Calendar265262635k+Output is not escaped
#1062Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More269727010k+error log error log
#1063Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty26113671400k+Non-prefixed global variable
#1064Conditional Logic for Woo Product Add-ons265751,352500Non-prefixed global variable
#1065Database for Contact Form 7, WPforms, Elementor forms2631748960k+Non-prefixed global variable
#1066CP Multi View Events Calendar26864391k+Non-prefixed global variable
#1067WP Frontend Admin – Display WP Admin Pages in the Frontend26347337500Non Singular String Literal Domain
#1068Ditty – Responsive News Tickers, Sliders, and Lists2656148430k+Output is not escaped
#1069Easy Appointments2613556910k+Alternative PHP tag found
#1070Accept Donations with PayPal & Stripe2691657210k+Unsafe printing function
#1071Easy Post Views Count265341,1802k+Non-prefixed global variable
#1072ELEX WooCommerce Google Shopping (Google Product Feed)262262421k+Text Domain Mismatch
#1073Event Monster – Event Manager, Ticket Booking & Registration26781781700Non-prefixed global variable
#1074Extra Product Options for WooCommerce265491,321600Non-prefixed global variable
#1075ezCache2612726910k+Direct Query
#1076RSS Redirect & Feedburner Alternative262772721k+Output is not escaped
#1077FG Drupal to WordPress26275100700Unsafe printing function
#1078FG PrestaShop to WooCommerce2625494900Unsafe printing function
#1079FlagShip WooCommerce Shipping26495188400Non Singular String Literal Domain
#1080Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager2611359790k+Non-prefixed global variable
#1081FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.)265914162k+Exception output is not escaped
#1082FV Antispam26332239900Output is not escaped
#1083GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites26284216500badly named files
#1084Hide Admin Bar Based on User Roles265491,34520k+Non-prefixed global variable
#1085Image SEO – AI-Driven Image SEO Optimizer263503271k+Text Domain Mismatch
#1086Integrate Razorpay for Contact Form 72615297500curl curl setopt
#1087Kadence Central – Site Management, Backups, Security, and Reporting2646221330k+Text Domain Mismatch
#1088Landing Page Cat – Coming Soon & Maintenance Pages2691180700Non-prefixed class
#1089Loco Translate264542421m+Output is not escaped
#1090Media File Renamer: Rename for better SEO (AI-Powered)2614817040k+Direct Query
#1091Hotel Booking266909404k+Unsafe printing function
#1092Online Contact Widget-多合一在线客服插件2670880800Non Singular String Literal Domain
#1093Open User Map – Interactive Leaflet Maps2689398610k+Non-prefixed global variable
#1094Organic Builder Widgets – Simple WordPress Page Builder261,0341254k+Output is not escaped
#1095Paytium: Mollie payment forms & donations265065513k+Unsafe printing function
#1096PDF for WPForms + Drag and Drop Template Builder266741131k+wp function not compatible with requires wp
#1097LoginWP (Formerly Peter's Login Redirect)2640127890k+Output is not escaped
#1098Polylang2636564800k+Non-prefixed hook name
#1099Portfolio by BestWebSoft – Work and Projects Presentation Plugin for WordPress26525240600Text Domain Mismatch
#1100Post List Designer – Category Post, Recent Post, Post List265421,3201k+Non-prefixed global variable