WordPress.DB.DirectDatabaseQuery.DirectQuery
Direct Query
The plugin runs a direct database query instead of using a higher-level WordPress API or cache-aware pattern.
Why It Shows Up
Plugin Check found `$wpdb` access that queries the database directly, changes schema, or bypasses normal caching expectations.
Why It Matters
Direct queries can be correct, but they are easier to make unsafe, slower at scale, and harder for WordPress to cache or filter.
How to Fix
- Use WordPress APIs such as post, term, metadata, option, or user functions when they fit the task.
- If direct SQL is necessary, prepare dynamic values and add a clear caching strategy for repeated reads.
- Keep schema changes in activation or upgrade routines and make them idempotent.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #2151 | Peter’s Post Notes | 36 | 224 | 102 | 3k+ | Output is not escaped | ||
| #2152 | Photonic Gallery & Lightbox for Flickr, SmugMug & Others | 36 | 180 | 117 | 10k+ | Missing Translators Comment | ||
| #2153 | Photoswipe Masonry Gallery | 36 | 57 | 47 | 6k+ | Non Singular String Literal Text | ||
| #2154 | Plugins Garbage Collector (Database Cleanup) | 36 | 32 | 51 | 10k+ | Missing nonce verification | ||
| #2155 | Post Views Stats Counter | 36 | 142 | 241 | 700 | Non-prefixed global variable | ||
| #2156 | ActiveCampaign Postmark for WordPress | 36 | 47 | 75 | 50k+ | Text Domain Mismatch | ||
| #2157 | WowStore – Store Builder & Product Blocks for WooCommerce | 36 | 56 | 437 | 4k+ | Non-prefixed global variable | ||
| #2158 | افزونه رسمی ترب | 36 | 42 | 86 | 20k+ | Exception output is not escaped | ||
| #2159 | Rara One Click Demo Import | 36 | 122 | 98 | 20k+ | Missing Translators Comment | ||
| #2160 | Better Find and Replace – AI-Powered Suggestions | 36 | 67 | 129 | 40k+ | Missing direct file access protection | ||
| #2161 | Recent Posts | 36 | 106 | 30 | 500 | Text Domain Mismatch | ||
| #2162 | Optimize Database after Deleting Revisions | 36 | 644 | 127 | 60k+ | Output is not escaped | ||
| #2163 | ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution | 36 | 63 | 667 | 100k+ | Non-prefixed global variable | ||
| #2164 | SMTP for SendGrid – YaySMTP | 36 | 27 | 96 | 1k+ | Non-prefixed global variable | ||
| #2165 | StaticPress | 36 | 88 | 79 | 500 | Output is not escaped | ||
| #2166 | Subscribe to Comments | 36 | 129 | 163 | 10k+ | Output is not escaped | ||
| #2167 | Supplier Order Email | 36 | 54 | 105 | 400 | Output is not escaped | ||
| #2168 | SureContact – Newsletters, Email Marketing, Automation, Revenue Tracking & CRM | 36 | 314 | 132 | 6k+ | Text Domain Mismatch | ||
| #2169 | SurveyJS: Drag & Drop Form Builder | 36 | 12 | 134 | 500 | Missing Version | ||
| #2170 | Sync QCloud COS | 36 | 63 | 109 | 600 | Non-prefixed function | ||
| #2171 | Bulk Product Editor plugin allows you to create and edit your WooCommerce products and categories with Google Sheets. | 36 | 50 | 105 | 400 | Direct Query | ||
| #2172 | Advance Side Cart, Ajax Cart & Floating Cart for WooCommerce | 36 | 37 | 121 | 6k+ | Non-prefixed global variable | ||
| #2173 | Plugin Name: Traffic Counter Widget Plugin | 36 | 71 | 107 | 600 | Output is not escaped | ||
| #2174 | Zoho ZeptoMail | 36 | 32 | 110 | 5k+ | Request data is not unslashed | ||
| #2175 | FOMO & Social Proof Notifications by TrustPulse – Best WordPress FOMO Plugin | 36 | 104 | 39 | 10k+ | Output is not escaped | ||
| #2176 | Ubigeo de Perú para Woocommerce y WordPress | 36 | 191 | 235 | 4k+ | Non-prefixed function | ||
| #2177 | Uji Countdown | 36 | 284 | 98 | 4k+ | Text Domain Mismatch | ||
| #2178 | PDF Flipbook, WPBakery Addon – Unreal FlipBook | 36 | 400 | 92 | 1k+ | Non Singular String Literal Domain | ||
| #2179 | Virtual Classroom – Video Conferencing & Online Meeting with BigBlueButton | 36 | 46 | 138 | 400 | Nonce verification recommended | ||
| #2180 | Video Thumbnails Reloaded | 36 | 343 | 58 | 2k+ | Text Domain Mismatch | ||
| #2181 | Quantity Plus Minus Button for WooCommerce | 36 | 83 | 84 | 10k+ | Output is not escaped | ||
| #2182 | Shipping with Venipak for WooCommerce | 36 | 239 | 61 | 1k+ | Text Domain Mismatch | ||
| #2183 | When Last Login | 36 | 52 | 123 | 50k+ | Non-prefixed global variable | ||
| #2184 | Widget Indicadores Económicos (Chile) | 36 | 53 | 20 | 500 | Output is not escaped | ||
| #2185 | Disable Payment Methods based on cart conditions for WooCommerce | 36 | 158 | 57 | 1k+ | Non Singular String Literal Domain | ||
| #2186 | Guaranteed Reviews Company (Société des Avis Garantis) | 36 | 369 | 197 | 1k+ | Output is not escaped | ||
| #2187 | Viva Payments – Viva Wallet WooCommerce Payment Gateway | 36 | 97 | 32 | 1k+ | Non Singular String Literal Domain | ||
| #2188 | Extended Coupon Features for WooCommerce FREE | 36 | 219 | 63 | 10k+ | Text Domain Mismatch | ||
| #2189 | Eway Payments for Woo | 36 | 525 | 40 | 3k+ | Text Domain Mismatch | ||
| #2190 | SuperFaktura WooCommerce | 36 | 60 | 116 | 2k+ | Nonce verification recommended | ||
| #2191 | Hide admin notices – Admin Notification Center | 36 | 114 | 67 | 8k+ | Output is not escaped | ||
| #2192 | WP Better Permalinks | 36 | 110 | 59 | 1k+ | Output is not escaped | ||
| #2193 | WP-Cleanup | 36 | 79 | 29 | 400 | Output is not escaped | ||
| #2194 | WP Coder – Insert & Manage Code Snippets | 36 | 53 | 280 | 10k+ | Nonce verification recommended | ||
| #2195 | WP Counter | 36 | 86 | 43 | 800 | Output is not escaped | ||
| #2196 | WP Custom Cursors | WordPress Cursor Plugin | 36 | 691 | 390 | 9k+ | Text Domain Mismatch | ||
| #2197 | WP-EMail | 36 | 340 | 95 | 1k+ | Unsafe printing function | ||
| #2198 | WP Header Images | 36 | 174 | 133 | 6k+ | Unsafe printing function | ||
| #2199 | WP Mail | 36 | 202 | 201 | 500 | Output is not escaped | ||
| #2200 | WP Hardening (discontinued) | 36 | 230 | 85 | 10k+ | Text Domain Mismatch |
