WordPress.DB.DirectDatabaseQuery.DirectQuery

Direct Query

The plugin runs a direct database query instead of using a higher-level WordPress API or cache-aware pattern.

medium weight

Why It Shows Up

Plugin Check found `$wpdb` access that queries the database directly, changes schema, or bypasses normal caching expectations.

Why It Matters

Direct queries can be correct, but they are easier to make unsafe, slower at scale, and harder for WordPress to cache or filter.

How to Fix

  • Use WordPress APIs such as post, term, metadata, option, or user functions when they fit the task.
  • If direct SQL is necessary, prepare dynamic values and add a clear caching strategy for repeated reads.
  • Keep schema changes in activation or upgrade routines and make them idempotent.

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#1351Post Grid Gutenberg Blocks – PostX2911840440k+Non-prefixed global variable
#1352Ultimate Auction for WooCommerce – Excellent WP Auction Plugin29525232k+Non-prefixed global variable
#1353User Verification by PickPlugins29413145k+Request data is not unslashed
#1354Visualizer – Tables & Charts Manager with Built-in AI Generator2934833120k+Output is not escaped
#1355Custom Post Types and Custom Fields creator – WCK291,30014310k+Text Domain Mismatch
#1356weMail – Email Marketing, Newsletter Builder & Email Automations for WooCommerce292766810k+Missing direct file access protection
#1357Countdown Timer – Widget Countdown2929015210k+Output is not escaped
#1358Widget for Yelp Reviews291471582k+Output is not escaped
#1359Product Carousel Slider & Grid Ultimate for WooCommerce297191226k+Text Domain Mismatch
#1360Global Payments SecureSubmit Gateway29199443600Non-prefixed class
#1361Woostify Sites Library2922919820k+Text Domain Mismatch
#1362WP-PostRatings2942538430k+Output is not escaped
#1363WPComplete293833331k+Output is not escaped
#1364Xagio SEO – AI Powered SEO2921,27310k+Direct Query
#1365Xpro Addons — 140+ Widgets for Elementor292782630k+Non-prefixed global variable
#1366Advanced Database Cleaner – Optimize & Clean Database to Speed Up Site Performance30173479100k+Interpolated SQL is not prepared
#1367PublishPress Blocks – Block Controls, Block Visibility, Block Permissions3023941720k+Non-prefixed global variable
#1368AI Product Tools – Bulk Product Content Generator & AI Toolkit for WooCommerce30508562400SQL query is not prepared
#1369Analytics Insights – Google Analytics Dashboard for WordPress3024117010k+Unsafe printing function
#1370ApplyOnline – Application Form Builder and Manager303452442k+Output is not escaped
#1371Contact Form 7 Connector303241965k+Text Domain Mismatch
#1372aThemes Starter Sites3026219540k+Text Domain Mismatch
#1373AutoWP – AI Content Writer & Rewriter305483701k+Text Domain Mismatch
#1374Private groups305833161k+Unsafe printing function
#1375Sliding Cart for WooCommerce by FunnelKit – Skip Cart & Reach WooCommerce Checkout Faster3030643430k+Non-prefixed global variable
#1376Cryptocurrency Donation Box – Bitcoin & Crypto Donations30334284500Output is not escaped
#1377Custom Search by BestWebSoft – WordPress Custom Search Plugin30454228900Text Domain Mismatch
#1378DethemeKit for Elementor3033522830k+Output is not escaped
#1379EDI – Обмен данными между WooCommerce и 1С30284101600Text Domain Mismatch
#1380Easy Affiliate Links301861987k+Missing direct file access protection
#1381EasyParcel Shipping– All-in-one Shipping Solution, Real-Time Shipping Rates3031610600Non-prefixed global variable
#1382Element Invader – Template Kits for Elementor302741303k+Output is not escaped
#1383Epeken All Kurir for Woocommerce305901,246400Missing nonce verification
#1384Eway Payment Gateway3050992800Missing Translators Comment
#1385PiWeb Export Customers Users & Guest customer to CSV for WooCommerce30173751k+Text Domain Mismatch
#1386FormLift for Keap (Legacy) Web Forms30162315400Request data is not unslashed
#1387Anti-spam, Spam protection, ReCaptcha for all forms and GDPR-compliant302642214k+Non Singular String Literal Text
#1388Kargo Takip, Kargo SMS, İlçe Mahalle Sözleşme by Hezarfen30702972k+Non-prefixed global variable
#1389Import WooCommerce Suite for Products, Orders, Coupons, Reviews, and Customers | WP Ultimate CSV Importer30804344k+Interpolated SQL is not prepared
#1390Invisible reCaptcha for WordPress309018580k+Input is not sanitized
#1391Jetpack Protect30657217100k+Text Domain Mismatch
#1392core plugin for kitestudio themes30244415500Nonce verification recommended
#1393Mailrelay303181701k+Text Domain Mismatch
#1394Naver webmaster syndication v23089129500Output is not escaped
#1395Nova Blocks by Pixelgrade30206112800Output is not escaped
#1396Novelist304751581k+Output is not escaped
#1397Operation Demo Importer – Demo Importer For WPoperation Themes302451041k+Text Domain Mismatch
#1398گرویتی فرم فارسی3020515720k+Text Domain Mismatch
#1399PitchPrint3076163400Input is not sanitized
#1400Popularis Extra302371417k+Output is not escaped