WordPress.DB.DirectDatabaseQuery.DirectQuery

Direct Query

The plugin runs a direct database query instead of using a higher-level WordPress API or cache-aware pattern.

medium weight

Why It Shows Up

Plugin Check found `$wpdb` access that queries the database directly, changes schema, or bypasses normal caching expectations.

Why It Matters

Direct queries can be correct, but they are easier to make unsafe, slower at scale, and harder for WordPress to cache or filter.

How to Fix

  • Use WordPress APIs such as post, term, metadata, option, or user functions when they fit the task.
  • If direct SQL is necessary, prepare dynamic values and add a clear caching strategy for repeated reads.
  • Keep schema changes in activation or upgrade routines and make them idempotent.

Affected Plugins

RankPluginScoreErrorsWarningsInstallsUpdatedTop Issue
#1851Optimus – WordPress Image Optimizer41522030k+Unsafe printing function
#1852OSS Aliyun4119403k+Request data is not unslashed
#1853Page & Post Notes4112771k+Non-prefixed global variable
#1854Pods – Custom Content Types and Fields415233100k+Direct Query
#1855Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News4153720k+Non-prefixed global variable
#1856Posts 2 Posts41427310k+Non Singular String Literal Domain
#1857Product Expiry for WooCommerce4131852k+Request data is not unslashed
#1858Simple Product Options for WooCommerce4162413k+Output is not escaped
#1859Responsive Plus – Elementor Templates & Starter Sites414630710k+Non-prefixed global variable
#1860ShinyStat Analytics4188251k+Output is not escaped
#1861Simple Lightbox412148100k+Nonce verification recommended
#1862Simple Page Access Restriction4166516k+Unsafe printing function
#1863Simple Revision Control4134431k+Dynamic hook name
#1864Squeeze – Image Optimization & Compression, WEBP Conversion4118712k+Nonce verification recommended
#1865Visibility Logic for Elementor41274330k+Output is not escaped
#1866WC Price History4118174k+SQL query is not prepared
#1867Country Based Restrictions for WooCommerce4127675k+Request data is not unslashed
#1868WP Media folders4119743k+Direct Query
#1869WP Test Email41322820k+Unsafe printing function
#1870WPS Hide Login4134722m+Nonce verification recommended
#1871Post Grid Master — Post Grids & AJAX Filters42441151k+Non-prefixed global variable
#1872Companion Revision Manager – Revision Control4218284k+Unsafe printing function
#1873Custom Fields for Gutenberg4224241k+Output is not escaped
#1874Custom Taxonomy Order42205650k+Output is not escaped
#1875Delete Expired Transients4249655k+Direct Query
#1876Enable Classic Editor & Widgets4210663k+Non Singular String Literal Domain
#1877Etsy Shop4258213k+Unsafe printing function
#1878Exclude Pages42311430k+Non Singular String Literal Domain
#1879FormCraft – Form Builder421861562k+Text Domain Mismatch
#1880Gelato Integration for WooCommerce4236325k+Output is not escaped
#1881Hide Cart Functions4212503k+Nonce verification recommended
#1882Image Uploader for Welcart4227243k+Output is not escaped
#1883Manage User Columns4215271k+Request data is not unslashed
#1884Nav Menu Collapse4217393k+Missing nonce verification
#1885PDF Thumbnail Generator4226162k+Output is not escaped
#1886Post Types Order424543600k+wp function not compatible with requires wp
#1887Proxy & VPN Blocker4210721k+Nonce verification recommended
#1888Rename wp-admin login4223388k+Output is not escaped
#1889Republish Old Posts4283242k+Output is not escaped
#1890Reusable Blocks Extended42381520k+Output is not escaped
#1891Secure Passkeys42146761k+Exception output is not escaped
#1892Sendcloud Shipping4278565k+Output is not escaped
#1893Simple Googlebot Visit4232671k+Non Singular String Literal Domain
#1894Speed Contact Bar4253205k+Output is not escaped
#1895Transients Manager42455020k+Output is not escaped
#1896Ultimate Category Excluder42222650k+Missing nonce verification
#1897Ultimate Coming Soon Page, Maintenance Mode & Under Construction – Gutenberg Block Builder & Landing Page42158910k+Non-prefixed global variable
#1898Auto Coupons for WooCommerce4281684k+Output is not escaped
#1899Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered)422,5831,82310k+Text Domain Mismatch
#1900WP Fingerprint4234479k+Direct Query