WordPress.DB.DirectDatabaseQuery.DirectQuery
Direct Query
The plugin runs a direct database query instead of using a higher-level WordPress API or cache-aware pattern.
Why It Shows Up
Plugin Check found `$wpdb` access that queries the database directly, changes schema, or bypasses normal caching expectations.
Why It Matters
Direct queries can be correct, but they are easier to make unsafe, slower at scale, and harder for WordPress to cache or filter.
How to Fix
- Use WordPress APIs such as post, term, metadata, option, or user functions when they fit the task.
- If direct SQL is necessary, prepare dynamic values and add a clear caching strategy for repeated reads.
- Keep schema changes in activation or upgrade routines and make them idempotent.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #1401 | Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget | 30 | 231 | 102 | 1k+ | Non Singular String Literal Domain | ||
| #1402 | Sync Master Sheet – Product Sync with Google Sheet for WooCommerce | 30 | 136 | 300 | 400 | Non-prefixed global variable | ||
| #1403 | Pubjet | پابجت | 30 | 91 | 172 | 1k+ | Output is not escaped | ||
| #1404 | QA Assistants – Driven by data | 30 | 4 | 867 | 2k+ | Non-prefixed global variable | ||
| #1405 | Real Cookie Banner: GDPR & ePrivacy Cookie Consent | 30 | 9 | 496 | 100k+ | Database parameter is not escaped | ||
| #1406 | Responsive Addons for Elementor – Free Elementor Addons, Kits and Elementor Templates | 30 | 60 | 387 | 3k+ | Non-prefixed global variable | ||
| #1407 | Rublon Multi-Factor Authentication (MFA) | 30 | 216 | 160 | 400 | Output is not escaped | ||
| #1408 | SmartCrawl SEO checker, analyzer & optimizer | 30 | 347 | 1,307 | 20k+ | Non-prefixed global variable | ||
| #1409 | SMTP for Amazon SES – YaySMTP | 30 | 197 | 122 | 3k+ | Exception output is not escaped | ||
| #1410 | Subscriptions for WooCommerce | 30 | 1 | 1,190 | 10k+ | Non-prefixed global variable | ||
| #1411 | Taboola | 30 | 89 | 147 | 1k+ | Output is not escaped | ||
| #1412 | User Avatar – Reloaded | 30 | 352 | 171 | 900 | Text Domain Mismatch | ||
| #1413 | User Role by BestWebSoft – Add and Customize Roles and Capabilities in WordPress | 30 | 484 | 280 | 3k+ | Text Domain Mismatch | ||
| #1414 | Waitlist Woocommerce ( Back in stock notifier ) | 30 | 272 | 311 | 4k+ | Output is not escaped | ||
| #1415 | Checkout with Cash App on WooCommerce | 30 | 122 | 308 | 2k+ | Non-prefixed global variable | ||
| #1416 | Dropify | 30 | 130 | 252 | 2k+ | Nonce verification recommended | ||
| #1417 | Webling | 30 | 147 | 313 | 500 | Input is not validated | ||
| #1418 | FOX – Currency Switcher Professional for WooCommerce | 30 | 211 | 1,022 | 50k+ | Non-prefixed global variable | ||
| #1419 | WooCommerce Stripe Payment Gateway | 30 | 173 | 591 | 700k+ | Non-prefixed hook name | ||
| #1420 | WooPayments: Integrated WooCommerce Payments | 30 | 182 | 308 | 900k+ | Exception output is not escaped | ||
| #1421 | WCPOS – Point of Sale (POS) plugin for WooCommerce | 30 | 77 | 228 | 5k+ | Nonce verification recommended | ||
| #1422 | WooCommerce Tax (formerly WooCommerce Shipping & Tax) | 30 | 103 | 198 | 600k+ | Non-prefixed class | ||
| #1423 | WP Docs | 30 | 268 | 271 | 1k+ | Output is not escaped | ||
| #1424 | WP Event Aggregator: Import Eventbrite events, Meetup events, social events and any iCal Events into Event Calendar | 30 | 113 | 419 | 1k+ | Non-prefixed global variable | ||
| #1425 | remarketable | 30 | 281 | 93 | 600 | Output is not escaped | ||
| #1426 | WP Inventory Manager | 30 | 856 | 233 | 1k+ | Output is not escaped | ||
| #1427 | WP Mail SMTP by WPForms – The Most Popular SMTP and Email Log Plugin | 30 | 32 | 346 | 4m+ | Non-prefixed hook name | ||
| #1428 | Photo Gallery Slideshow & Masonry Tiled Gallery | 30 | 806 | 352 | 1k+ | Output is not escaped | ||
| #1429 | WP Restaurant Price List | 30 | 295 | 95 | 500 | Text Domain Mismatch | ||
| #1430 | WPOrLogin – Custom Login, Social Login, Limit Attempts, Hide Login & reCAPTCHA | 30 | 484 | 222 | 2k+ | Unsafe printing function | ||
| #1431 | WPS Cleaner | 30 | 430 | 491 | 20k+ | Output is not escaped | ||
| #1432 | YayPricing – WooCommerce Dynamic Pricing & Discounts | 30 | 174 | 186 | 3k+ | Non-prefixed global variable | ||
| #1433 | YASR – Yet Another Star Rating Plugin for WordPress | 30 | 252 | 378 | 10k+ | Output is not escaped | ||
| #1434 | YITH Pre-Order for WooCommerce | 30 | 397 | 1,464 | 6k+ | Non-prefixed global variable | ||
| #1435 | YITH WooCommerce Popup | 30 | 395 | 1,551 | 2k+ | Non-prefixed global variable | ||
| #1436 | YITH WooCommerce Product Slider Carousel | 30 | 389 | 1,479 | 4k+ | Non-prefixed global variable | ||
| #1437 | Zoho CRM Lead Magnet | 30 | 101 | 1,025 | 3k+ | Request data is not unslashed | ||
| #1438 | Extra Product Options Builder for WooCommerce | 31 | 113 | 194 | 2k+ | Non-prefixed global variable | ||
| #1439 | Advanced Category Excluder | 31 | 349 | 160 | 700 | Output is not escaped | ||
| #1440 | Advanced Woo Search – Product Search for WooCommerce | 31 | 229 | 377 | 70k+ | Nonce verification recommended | ||
| #1441 | AI Copilot – Content Generator | 31 | 159 | 163 | 1k+ | wp function not compatible with requires wp | ||
| #1442 | All-in-one contact buttons – WPSHARE247 | 31 | 108 | 113 | 4k+ | Non-prefixed global variable | ||
| #1443 | Titan Anti-spam & Security – Brute Force Protection, 2FA & Spam Filter | 31 | 57 | 196 | 50k+ | Nonce verification recommended | ||
| #1444 | APCu Manager | 31 | 153 | 136 | 10k+ | Output is not escaped | ||
| #1445 | Asgaros Forum | 31 | 167 | 412 | 10k+ | Output is not escaped | ||
| #1446 | The SEO Framework – Fast, Automated, Effortless. | 31 | 363 | 609 | 200k+ | Non-prefixed global variable | ||
| #1447 | AI ChatBot with ChatGPT and Content Generator by AYS | 31 | 170 | 378 | 400 | Non-prefixed global variable | ||
| #1448 | SEO合集(支持百度/Google/Bing/头条推送) | 31 | 13 | 1,407 | 800 | Direct Query | ||
| #1449 | Яндекс Доставка (Boxberry) | 31 | 46 | 150 | 600 | Missing nonce verification | ||
| #1450 | Buy Me a Coffee – Button and Widget Plugin | 31 | 138 | 140 | 6k+ | Output is not escaped |
