PluginScore

WordPress.DB.DirectDatabaseQuery.DirectQuery

Direct Query

The plugin runs a direct database query instead of using a higher-level WordPress API or cache-aware pattern.

medium weight

Why It Shows Up

Plugin Check found `$wpdb` access that queries the database directly, changes schema, or bypasses normal caching expectations.

Why It Matters

Direct queries can be correct, but they are easier to make unsafe, slower at scale, and harder for WordPress to cache or filter.

How to Fix

  • Use WordPress APIs such as post, term, metadata, option, or user functions when they fit the task.
  • If direct SQL is necessary, prepare dynamic values and add a clear caching strategy for repeated reads.
  • Keep schema changes in activation or upgrade routines and make them idempotent.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#151Captcha by BestWebSoft – Advanced Spam Protection, Math & OCR-Friendly Captcha for Site Forms2249329510k+Text Domain Mismatch
#152Cart Lift – Abandoned Cart Recovery for WooCommerce and EDD226697691k+Output is not escaped
#153Cleanup Action Scheduler225451,3061k+Non-prefixed global variable
#154Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer222,8581,27050k+Text Domain Mismatch
#155Code Profiler – WordPress Performance Profiling and Debugging Made Easy222654008k+Non-prefixed global variable
#156Accept PayPal Payments using Contact Form 722359127600Text Domain Mismatch
#157Passster – Password Protect Pages and Content225391,41910k+Non-prefixed global variable
#158Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates222,1754,2107k+Non-prefixed global variable
#159RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login223,6535,0848k+Non-prefixed global variable
#160Data Tables Generator by Supsystic2215815210k+Exception output is not escaped
#161Directorist: AI-Powered Business Directory, Listings & Classified Ads225492,17720k+Non-prefixed global variable
#162DirectoryPress – Business Directory And Classified Ad Listing224,7872,795800Text Domain Mismatch
#163Download Manager222,5131,459100k+Output is not escaped
#164Diverse Solutions IDX Real Estate Listings & MLS Search227456051k+Heredoc Output Not Escaped
#165Dynamic QR Code – generator222382086k+Missing direct file access protection
#166E2Pdf – Export Pdf Tool for WordPress221,08284710k+Unsafe printing function
#167Easy Social Feed – Social Photos Gallery and Post Feed for WordPress221,5671,27730k+Non-prefixed global variable
#168easyReservations225,3072,480800Text Domain Mismatch
#169EleSpare – News, Magazine and Blog Addons for Elementor227331,42310k+Non-prefixed global variable
#170Employee Spotlight – Team Member Showcase & Meet the Team Plugin22247689400Non-prefixed hook name
#171Estatik Real Estate Plugin223,04932510k+Text Domain Mismatch
#172Events Maker by dFactory225888191k+Output is not escaped
#173Events Manager – Calendar, Bookings, Tickets, and more!224,7135,66070k+Output is not escaped
#174FACTO – Facturación Electrónica22242432400Request data is not unslashed
#175Falang multilanguage for WordPress227167691k+Output is not escaped
#176Finale Lite – Sales Countdown Timer & Discount for WooCommerce221,0314514k+Output is not escaped
#177FireBox Popups – Increase Sales and Grow Your Email List221578267k+Non-prefixed global variable
#178Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder22407236700k+Text Domain Mismatch
#179Notification Bar, Announcement and Cookie Notice WordPress Plugin – FooBar221,3211,3713k+Non-prefixed global variable
#180Five Star Restaurant Menu and Food Ordering227526095k+Output is not escaped
#181FunnelKit Payment Gateway for Stripe WooCommerce2224432120k+Input is not sanitized
#182GeoDirectory – WP Business Directory Plugin and Classified Listings Directory224,4653,97410k+Output is not escaped
#183Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms221,03172220k+Unsafe printing function
#184HeadSpace2 SEO229403603k+Text Domain Mismatch
#185Hesabfa Accounting22467718400Text Domain Mismatch
#186History Log by click5226751,290400Direct Query
#187Csomagpontok és Címkék WooCommerce-hez222,0017697k+Text Domain Mismatch
#188IMPress for IDX Broker221,0856366k+Text Domain Mismatch
#189Insert or Embed Articulate Content into WordPress226591,4372k+Non-prefixed global variable
#190Számlázz.hu integráció WooCommerce-hez221,1694607k+Text Domain Mismatch
#191The Innovative Form Builder – IvyForms22750309600Exception output is not escaped
#192InfiniteWP Client222,2861,812200k+Exception output is not escaped
#193Import WP – Export and Import CSV and XML files to WordPress225803304k+Exception output is not escaped
#194Jetpack – WP Security, Backup, Speed, & Growth222,9751,3483m+Text Domain Mismatch
#195LearnPress – WordPress LMS Plugin for Create and Sell Online Courses222,3693,34970k+Non-prefixed global variable
#196Custom Login Page Customizer – Login Designer225881,45530k+Non-prefixed global variable
#197Mail Baby SMTP22385699600SQL query is not prepared
#198MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.222,6252,45810k+Output is not escaped
#199MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution221,1311,844800Non-prefixed global variable
#200Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider22207323500k+Non-prefixed global variable