PluginScore

WordPress.DB.DirectDatabaseQuery.DirectQuery

Direct Query

The plugin runs a direct database query instead of using a higher-level WordPress API or cache-aware pattern.

medium weight

Why It Shows Up

Plugin Check found `$wpdb` access that queries the database directly, changes schema, or bypasses normal caching expectations.

Why It Matters

Direct queries can be correct, but they are easier to make unsafe, slower at scale, and harder for WordPress to cache or filter.

How to Fix

  • Use WordPress APIs such as post, term, metadata, option, or user functions when they fit the task.
  • If direct SQL is necessary, prepare dynamic values and add a clear caching strategy for repeated reads.
  • Keep schema changes in activation or upgrade routines and make them idempotent.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#201Modula Image Gallery – Photo Grid & Video Gallery22474436100k+Text Domain Mismatch
#202Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress229191,23010k+Output is not escaped
#203Motors – Car Dealership & Classified Listings Plugin225,3405,9599k+Text Domain Mismatch
#204myCred Addons – Ultimate myCred Modules To Support WordPress Gamification and Loyalty Rewards222,3441,320400Output is not escaped
#205Newsletters222,9682,2482k+Text Domain Mismatch
#206NinjaFirewall (WP Edition) – Advanced Security Plugin and Firewall221,2722,063100k+Non-prefixed global variable
#207NinjaScanner – Virus & Malware scan2259655130k+Non-prefixed global variable
#208WP OAuth Server (OAuth Authentication)221893473k+Non-prefixed function
#209oik224891802k+Non Singular String Literal Domain
#210PagBank / PagSeguro Connect para WooCommerce225057574k+Non-prefixed global variable
#211PAYCOMET for WooCommerce221,2064232k+Text Domain Mismatch
#212PDF Builder for WPForms22321266900SQL query is not prepared
#213Smart Popup by Supsystic223,17250310k+Non Singular String Literal Domain
#214Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App221,5812,326300k+Non-prefixed global variable
#215Premium Addons for Elementor – Powerful Elementor Templates & Widgets222331,036700k+Non-prefixed hook name
#216Prime Mover – Migrate WordPress Website & Backups221,3261,60010k+Non-prefixed global variable
#217Product Catalog Feed by PixelYourSite225813578k+Output is not escaped
#218Pronamic Pay222581,0772k+Non-prefixed global variable
#219PageSpeed Ninja – Cache, Minify, Defer CSS JavaScript, Critical CSS, Optimize Images, Convert WebP229844075k+Unsafe printing function
#220RealPress – Real Estate Plugin226041,167500Non-prefixed global variable
#221Restrict User Access – Ultimate Membership & Content Protection229771,84010k+Non-prefixed global variable
#222Salon Booking System – Free Version226556202k+Missing direct file access protection
#223Social Sharing Plugin – Sassy Social Share221,689233100k+wp function not compatible with requires wp
#224Sellsy22586490400Non Singular String Literal Domain
#225Seraphinite Accelerator2259425550k+Output is not escaped
#226ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF221,044800300k+Non-prefixed global variable
#227Simple Job Board226341,35510k+Non-prefixed global variable
#228Slick Popup: Contact Form 7 Popup Plugin222,3223162k+Text Domain Mismatch
#229Slim Jetpack222,5861,9472k+Text Domain Mismatch
#230SNS Count Cache229181208k+Non Singular String Literal Domain
#231NextScripts: Social Networks Auto-Poster222,4081,13320k+Output is not escaped
#232SSL Zen — SSL Certificate Installer & HTTPS Redirects227511,60510k+Non-prefixed global variable
#233Stylish Price List – Price Table Builder & QR Code Restaurant Menu226746783k+Output is not escaped
#234SVG Flags – Beautiful Scalable Flags For All Countries!227551,2512k+Non-prefixed global variable
#235Swift Performance Lite222,3461,3256k+Text Domain Mismatch
#236Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent222255198k+error log error log
#237Ultimate Carousel For Divi225901,566800Non-prefixed global variable
#238Ultimeter227511,3441k+Non-prefixed global variable
#239Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin225222,36740k+Direct Query
#240Uncanny Toolkit for LearnDash2253999420k+Output is not escaped
#241Unlimited Elements Blocks Library227081,822400Non-prefixed global variable
#242RapidLoad AI – Optimize Web Vitals Automatically2281840700Nonce verification recommended
#243Search & Replace Everything – Quick and Easy Way to Find and Replace Text, Links221,0441,79720k+Non-prefixed global variable
#244UpStream: a Project Management Plugin for WordPress22683703600Non-prefixed global variable
#245Welcart e-Commerce2210,37810,93110k+Text Domain Mismatch
#246Walker Core221,3511,436700Non-prefixed global variable
#247WCFM – Frontend Manager for WooCommerce224,7545,05420k+Non-prefixed global variable
#248WCFM Marketplace – Multivendor Marketplace for WooCommerce221,9341,96610k+Non-prefixed global variable
#249WCFM Membership – WooCommerce Memberships for Multivendor Marketplace2255967510k+Non-prefixed global variable
#250Wenprise WeChatPay Payment Gateway For WooCommerce22443178400Exception output is not escaped