WordPress.DB.DirectDatabaseQuery.DirectQuery
Direct Query
The plugin runs a direct database query instead of using a higher-level WordPress API or cache-aware pattern.
Why It Shows Up
Plugin Check found `$wpdb` access that queries the database directly, changes schema, or bypasses normal caching expectations.
Why It Matters
Direct queries can be correct, but they are easier to make unsafe, slower at scale, and harder for WordPress to cache or filter.
How to Fix
- Use WordPress APIs such as post, term, metadata, option, or user functions when they fit the task.
- If direct SQL is necessary, prepare dynamic values and add a clear caching strategy for repeated reads.
- Keep schema changes in activation or upgrade routines and make them idempotent.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #1601 | WP Bannerize Pro | 32 | 281 | 216 | 800 | Text Domain Mismatch | ||
| #1602 | wp-jalali | 32 | 219 | 66 | 10k+ | Text Domain Mismatch | ||
| #1603 | WP Popup | 32 | 539 | 65 | 1k+ | Text Domain Mismatch | ||
| #1604 | SEOPress – AI SEO Plugin & On-site SEO | 32 | 138 | 429 | 300k+ | Non-prefixed global variable | ||
| #1605 | WP-Stats | 32 | 237 | 126 | 2k+ | Output is not escaped | ||
| #1606 | WP Weixin | 32 | 60 | 152 | 400 | Non-prefixed constant | ||
| #1607 | WPCasa – Real Estate for WordPress | 32 | 85 | 429 | 1k+ | Non-prefixed global variable | ||
| #1608 | wpDirAuth | 32 | 250 | 135 | 500 | wp function not compatible with requires wp | ||
| #1609 | Privacy Policy Generator – WPLP Legal Pages | 32 | 26 | 409 | 10k+ | Non-prefixed global variable | ||
| #1610 | WT GeoTargeting | 32 | 89 | 43 | 1k+ | Output is not escaped | ||
| #1611 | Dynamic XML Sitemaps Generator for Google | 32 | 74 | 411 | 20k+ | Non-prefixed global variable | ||
| #1612 | YITH Infinite Scrolling | 32 | 387 | 1,417 | 10k+ | Non-prefixed global variable | ||
| #1613 | YITH WooCommerce Badge Management | 32 | 413 | 1,446 | 10k+ | Non-prefixed global variable | ||
| #1614 | YITH WooCommerce Compare | 32 | 422 | 1,508 | 100k+ | Non-prefixed global variable | ||
| #1615 | YITH WooCommerce Quick View | 32 | 388 | 1,420 | 90k+ | Non-prefixed global variable | ||
| #1616 | Yoo Slider – Image Slider & Video Slider | 32 | 744 | 209 | 600 | Output is not escaped | ||
| #1617 | Advanced Forms for ACF | 33 | 169 | 278 | 3k+ | Non-prefixed hook name | ||
| #1618 | Affiliate Program & Referral Tracking for WooCommerce & WordPress – Affilia | 33 | 80 | 172 | 500 | Nonce verification recommended | ||
| #1619 | AI WP Writer – SEO content generator, chatGPT, Gemini | 33 | 581 | 531 | 3k+ | Text Domain Mismatch | ||
| #1620 | Archive Posts Sort Customize | 33 | 338 | 97 | 600 | Output is not escaped | ||
| #1621 | Auto Listings – Car Listings & Car Dealership Plugin for WordPress | 33 | 80 | 321 | 2k+ | Non-prefixed global variable | ||
| #1622 | Premium Portfolio Features for Phlox theme | 33 | 204 | 137 | 40k+ | Output is not escaped | ||
| #1623 | AWeber – Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth | 33 | 33 | 229 | 9k+ | Non-prefixed global variable | ||
| #1624 | Bosta WooCommerce | 33 | 303 | 180 | 700 | Text Domain Mismatch | ||
| #1625 | Addi – Cuotas que se adaptan a ti | 33 | 106 | 209 | 2k+ | Direct Query | ||
| #1626 | Nexi XPay | 33 | 496 | 277 | 6k+ | Text Domain Mismatch | ||
| #1627 | CartPops – High Converting Add To Cart Popup For WooCommerce | 33 | 63 | 188 | 4k+ | Non-prefixed global variable | ||
| #1628 | Century ToolKit | 33 | 118 | 78 | 800 | Output is not escaped | ||
| #1629 | Chartify – WordPress Chart Plugin | 33 | 76 | 411 | 3k+ | Non-prefixed global variable | ||
| #1630 | ChatHelp – Click to Chat Button, WooCommerce Chat to Order & Floating Chat Form | 33 | 57 | 204 | 1k+ | Non-prefixed global variable | ||
| #1631 | Clicky Analytics | 33 | 166 | 92 | 10k+ | Output is not escaped | ||
| #1632 | Companion Auto Update | 33 | 159 | 298 | 40k+ | Direct Query | ||
| #1633 | Companion Sitemap Generator – Simple, Smart, and SEO-Ready | 33 | 118 | 57 | 7k+ | Missing Translators Comment | ||
| #1634 | Contact List – Online Staff Directory & Address Book | 33 | 118 | 342 | 1k+ | Nonce verification recommended | ||
| #1635 | Chatbot with IBM watsonx Assistant | 33 | 324 | 83 | 400 | Non Singular String Literal Domain | ||
| #1636 | Countdown Timer | 33 | 311 | 17 | 900 | Text Domain Mismatch | ||
| #1637 | Device Detector | 33 | 209 | 112 | 600 | Output is not escaped | ||
| #1638 | Easy Timer | 33 | 78 | 450 | 1k+ | Non-prefixed global variable | ||
| #1639 | Easy Upload Files During Checkout | 33 | 218 | 199 | 500 | Unsafe printing function | ||
| #1640 | EchBay Phonering Alo | 33 | 74 | 47 | 1k+ | Output is not escaped | ||
| #1641 | FastPixel Cache – Optimize Page Speed: Compress Images, Minify, Clean Database & CDN | 33 | 51 | 333 | 4k+ | Request data is not unslashed | ||
| #1642 | Gallery Custom Links | 33 | 64 | 62 | 30k+ | Non Singular String Literal Domain | ||
| #1643 | GDPR Cookie Compliance – Cookie Banner, Cookie Consent, Cookie Notice for CCPA, EU Cookie Law | 33 | 48 | 370 | 300k+ | Non-prefixed global variable | ||
| #1644 | GetResponse Forms by Optin Cat | 33 | 68 | 138 | 1k+ | Missing direct file access protection | ||
| #1645 | Five Star Restaurant Reviews | 33 | 242 | 142 | 400 | Output is not escaped | ||
| #1646 | Comments – GraphComment | AI-Moderated Comment System | 33 | 191 | 177 | 400 | Unsafe printing function | ||
| #1647 | GSheetConnector for Forminator Forms | 33 | 128 | 201 | 1k+ | Non-prefixed global variable | ||
| #1648 | Ultimate Addons for Elementor | 33 | 81 | 291 | 2m+ | Non-prefixed class | ||
| #1649 | HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce | 33 | 377 | 139 | 20k+ | Unsafe printing function | ||
| #1650 | Flipbox – Awesomes Flip Boxes Image Overlay | 33 | 400 | 7,279 | 10k+ | Input is not validated |