PluginScore

WordPress.DB.DirectDatabaseQuery.DirectQuery

Direct Query

The plugin runs a direct database query instead of using a higher-level WordPress API or cache-aware pattern.

medium weight

Why It Shows Up

Plugin Check found `$wpdb` access that queries the database directly, changes schema, or bypasses normal caching expectations.

Why It Matters

Direct queries can be correct, but they are easier to make unsafe, slower at scale, and harder for WordPress to cache or filter.

How to Fix

  • Use WordPress APIs such as post, term, metadata, option, or user functions when they fit the task.
  • If direct SQL is necessary, prepare dynamic values and add a clear caching strategy for repeated reads.
  • Keep schema changes in activation or upgrade routines and make them idempotent.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#1201Tutor LMS Elementor Addons3122745730k+Non-prefixed global variable
#1202User Spam Remover31115141k+Output is not escaped
#1203Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & Checkout Verification312848302k+Missing nonce verification
#1204Web Push Notifications – Webpushr3116929310k+Output is not escaped
#1205Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker31639336k+Interpolated SQL is not prepared
#1206Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets31837295100k+Unsafe printing function
#1207WooCommerce Legacy REST API31324177400k+Missing Translators Comment
#1208Tooltips for WordPress313122525k+Output is not escaped
#1209WPGatsby31125553k+Text Domain Mismatch
#1210HireZoot – (WP Job Openings) Job Listings, Career Page & Recruitment Tool311453940k+Non-prefixed global variable
#1211WP Simple Booking Calendar3133738120k+Output is not escaped
#1212WP Visitor Statistics (Real Time Traffic)3135369120k+Nonce verification recommended
#1213WP ULike – Like & Dislike Buttons for Engagement and Feedback3126935860k+Output is not escaped
#1214WP125311781843k+Unsafe printing function
#1215Hosting Benchmark tool312021154k+rand rand
#1216YITH Color and Label Variations for WooCommerce313931,4289k+Non-prefixed global variable
#1217YITH WooCommerce Brands Add-On313931,4259k+Non-prefixed global variable
#1218YITH WooCommerce Catalog Mode313801,41860k+Non-prefixed global variable
#1219YITH WooCommerce Featured Video313831,4343k+Non-prefixed global variable
#1220YITH Frequently Bought Together for WooCommerce313891,4528k+Non-prefixed global variable
#1221YITH WooCommerce Order & Shipment Tracking313801,4207k+Non-prefixed global variable
#1222YITH Request a Quote for WooCommerce314081,48110k+Non-prefixed global variable
#1223YITH WooCommerce Tab Manager313951,4294k+Non-prefixed global variable
#1224Zendesk Support for WordPress31195882k+Output is not escaped
#1225PayPal Zettle POS for WooCommerce31302444k+Exception output is not escaped
#1226ActiveDEMAND321571611k+Output is not escaped
#1227Advanced Access Manager – Access Governance for WordPress3284962100k+Output is not escaped
#1228annasta Filters for WooCommerce321,0734412k+Text Domain Mismatch
#1229APCu Manager3215112610k+Output is not escaped
#1230Author Avatars List/Block32851354k+Non-prefixed hook name
#1231Auto YouTube Importer323381731k+Text Domain Mismatch
#1232Better Chat Support for Messenger32721031k+Interpolated SQL is not prepared
#1233Blog2Social: Social Media Auto Post & Scheduler32796250k+Direct Query
#1234BuddyPress for LearnDash321902841k+Output is not escaped
#1235Addi – Cuotas que se adaptan a ti321062102k+Direct Query
#1236Vimeotheque – Vimeo WordPress Plugin & Video Gallery326422642k+Unsafe printing function
#1237Cooked – Recipe Management324622753k+Output is not escaped
#1238Currency Switcher for WooCommerce3235726310k+Text Domain Mismatch
#1239Download Attachments32691888k+Non-prefixed hook name
#1240Enter Addons – Ultimate Template Builder for Elementor3282721k+Output is not escaped
#1241Fable Extra32792824k+Non-prefixed global variable
#1242Freesoul Deactivate Plugins – Disable plugins on individual WordPress pages32537739k+Nonce verification recommended
#1243CRM Perks Integration for Gravity Forms and Salesforce328071781k+Text Domain Mismatch
#1244Insights from Google PageSpeed3241447520k+Text Domain Mismatch
#1245GSheetConnector For Ninja Forms32165931k+Unsafe printing function
#1246GSheetConnector For WPForms – WPForms Google Sheets Integration (Real-Time Sync)321201458k+Non-prefixed global variable
#1247Gwolle Guestbook3226952720k+Output is not escaped
#1248HTML5 jQuery Audio Player322511531k+Unsafe printing function
#1249HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce3239614220k+Output is not escaped
#1250ThumbPress – Compress Images, Manage Thumbnails, Detect Image Issues, WebP/AVIF, Lazy Loading, Hotlinking & More3210130830k+Non-prefixed global variable