PluginScore

WordPress.DB.DirectDatabaseQuery.DirectQuery

Direct Query

The plugin runs a direct database query instead of using a higher-level WordPress API or cache-aware pattern.

medium weight

Why It Shows Up

Plugin Check found `$wpdb` access that queries the database directly, changes schema, or bypasses normal caching expectations.

Why It Matters

Direct queries can be correct, but they are easier to make unsafe, slower at scale, and harder for WordPress to cache or filter.

How to Fix

  • Use WordPress APIs such as post, term, metadata, option, or user functions when they fit the task.
  • If direct SQL is necessary, prepare dynamic values and add a clear caching strategy for repeated reads.
  • Keep schema changes in activation or upgrade routines and make them idempotent.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#101MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder211,1333,0112k+Non-prefixed global variable
#102Mapster WP Maps213,4402,9033k+Text Domain Mismatch
#103Mergado Pack212,323588700Output is not escaped
#104Modular DS: Monitor, update, and backup multiple websites211598140k+Exception output is not escaped
#105Mooberry Book Manager211,0403991k+Text Domain Mismatch
#106MotoPress Hotel Booking213,0631,03710k+Text Domain Mismatch
#107Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred211,4783,33710k+Non-prefixed global variable
#108Oasis Workflow21775575700Text Domain Mismatch
#109Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages211,1202,9139k+Non-prefixed global variable
#110Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction211,9345,24810k+Non-prefixed hook name
#111User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor217031,46340k+Missing Translators Comment
#112PublishPress Planner – Editorial Calendar, Marketing Content, Kanban Board216038906k+Output is not escaped
#113Quill Forms | Conversational Multi Step Forms, Surveys & quizzes214013693k+Text Domain Mismatch
#114Razorpay for Gravity Forms2141147600Exception output is not escaped
#115Five Star Restaurant Reservations – WordPress Booking Plugin211,1011,15910k+Output is not escaped
#116Rocket Maintenance Mode & Coming Soon Page211,1761,4064k+Non-prefixed global variable
#117Royal Addons for Elementor – Addons and Templates Kit for Elementor2113,0112,530600k+Text Domain Mismatch
#118Seamless Donations is Sunset216005142k+Text Domain Mismatch
#119SeatReg213121,637400Missing nonce verification
#120Professional Social Sharing Buttons, Icons & Related Posts – Shareaholic2132718110k+Output is not escaped
#121Smart Forms – when you need more than just a contact form217765745k+Output is not escaped
#122Accept Stripe Payments2137388420k+Missing nonce verification
#123ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin2119066030k+Non-prefixed global variable
#124Revive Social – Social Media Auto Post and Scheduling Automation Plugin2125643120k+Non-prefixed hook name
#125UPC/EAN/GTIN Barcode Generator/Importer21776311500Exception output is not escaped
#126URL Shortify – Simple and Easy URL Shortener211,5192,68710k+Non-prefixed global variable
#127Buckaroo Woocommerce Payments Plugin216383212k+Exception output is not escaped
#128BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages216681,569800Non-prefixed global variable
#129WebP Express21160427300k+Non-prefixed global variable
#130Wise Chat214705065k+Output is not escaped
#131Paysera Payment Gateway for WooCommerce211,8661957k+Exception output is not escaped
#132Pay For Post with WooCommerce219601,4741k+Non-prefixed global variable
#133Wordfence Security – Firewall, Malware Scan, and Login Security211,5922,9735m+Output is not escaped
#134WP Compress – Instant Performance & Speed Optimization213,3673,25310k+Non Singular String Literal Domain
#135WP-Lister Lite for eBay216,6975,1292k+Output is not escaped
#136WP phpMyAdmin214,5286,43550k+Missing Arg Domain
#137wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin211,8111,43270k+Output is not escaped
#138WP Extended – The Ultimate WordPress Toolkit211,253398600Non Singular String Literal Domain
#139WPScan – WordPress Security Scanner215272658k+Text Domain Mismatch
#140WebTotem Security211,110213900Text Domain Mismatch
#14112 Step Meeting List22156593900Non-prefixed global variable
#142WP Sessions Time Monitoring Full Automatic228691,529500Non-prefixed global variable
#143Advanced Classifieds & Directory Pro221,2293,5122k+Non-prefixed global variable
#144Ajax Load More – Infinite Scroll, Load More, & Lazy Load2264159540k+Unsafe printing function
#145All-in-One Video Gallery229112,89220k+Non-prefixed global variable
#146Author Website Templates – Create Writer, Author & Publisher Websites Easily227112,910500Non-prefixed global variable
#147Backup Bolt225801,313800Non-prefixed global variable
#148Knowledge Base documentation & wiki plugin – BasePress Docs226711,7672k+Non-prefixed global variable
#149Borderless – Addons and Templates for Elementor224381,3885k+Non-prefixed global variable
#150Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots221,6072,02010k+Direct Query