PluginScore

WordPress.DB.DirectDatabaseQuery.DirectQuery

Direct Query

The plugin runs a direct database query instead of using a higher-level WordPress API or cache-aware pattern.

medium weight

Why It Shows Up

Plugin Check found `$wpdb` access that queries the database directly, changes schema, or bypasses normal caching expectations.

Why It Matters

Direct queries can be correct, but they are easier to make unsafe, slower at scale, and harder for WordPress to cache or filter.

How to Fix

  • Use WordPress APIs such as post, term, metadata, option, or user functions when they fit the task.
  • If direct SQL is necessary, prepare dynamic values and add a clear caching strategy for repeated reads.
  • Keep schema changes in activation or upgrade routines and make them idempotent.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#3151Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative)6933379200k+Direct Query
#3152CDN Enabler6914710k+Output is not escaped
#3153Contact Form 769563910m+Missing direct file access protection
#3154CryptX69113010k+Missing nonce verification
#3155DOKU Payment695346400wp function not compatible with requires wp
#3156GZSEO69366400Direct Query
#3157PDF.js Viewer69143820k+Non-prefixed global variable
#3158Scroll Down Arrow693030800Missing Arg Domain
#3159Search by SKU for Woocommerce69131010k+Direct Query
#3160Easy Username Updater69192810k+Missing Arg Domain
#3161Export WordPress Menus6994221k+wp function not compatible with requires wp
#3162Ambrosite Next/Previous Page Link Plus701121900Interpolated SQL is not prepared
#3163AppScenic – Smart AI Dropshipping7016413k+Dynamic hook name
#3164FAZ Cookie Manager70315900Non-prefixed hook name
#3165Portfolio Post Type7071150k+Nonce verification recommended
#3166Search and Replace707910k+Input is not sanitized
#3167Simple Login Captcha70201910k+date date
#3168Smart WYSIWYG Blocks Of Content703641k+Output is not escaped
#3169Spocket ‑ US & EU Dropshipping7015311k+Direct Query
#3170Export Users With Meta7013132k+Direct Query
#3171Download Manager Addons for Elementor70272136k+Non Singular String Literal Domain
#3172aapanel WP Toolkit7120182k+wp function not compatible with requires wp
#3173BuddyPress Default Data71821400Interpolated SQL is not prepared
#3174GPX Viewer711026900Missing Version
#3175Multiple Roles717205k+Non-prefixed global variable
#3176Nginx Helper714760200k+Non-prefixed global variable
#3177Privyr CRM – Instant Lead Alerts for Contact Forms712254k+Non-prefixed function
#3178SmartSMTP718422k+Nonce verification recommended
#3179WooCommerce Shipping714870k+Direct Query
#3180WPGraphQL Smart Cache718797k+Text Domain Mismatch
#3181Bulk Term Editor72199400Output is not escaped
#3182Disable Title7220152k+Text Domain Mismatch
#3183Discontinued Product Stock Status for WooCommerce72151500Missing nonce verification
#3184EU Order Withdrawal Button for WooCommerce72524064k+Non-prefixed hook name
#3185Media Library Organizer – Folders, File Manager & Media Categories722013020k+Non-prefixed global variable
#3186Responsive Blocks – Page Builder for Blocks & Patterns7247433k+badly named files
#3187Shipping Rate By Cities72421700Direct Query
#3188Templ Optimizer726631k+Direct Query
#3189Starter Templates & Sites Pack by ThemeGrill72285170k+Non-prefixed hook name
#3190TinyPNG – JPEG, PNG & WebP image compression724073100k+Non-prefixed global variable
#3191Ultimate Member Custom Tab Builder Lite721215500Output is not escaped
#3192Place Order Without Payment for WooCommerce72244623k+Text Domain Mismatch
#3193Direct Checkout for WooCommerce72773580k+Text Domain Mismatch
#3194OpenID Connect Generic Client7395910k+Non-prefixed hook name
#3195Emergency password reset735614800wp function not compatible with requires wp
#3196EU Withdrawal Button for WooCommerce7327400Missing nonce verification
#3197My Simple Space732138k+Output is not escaped
#3198Permalinks Moved Permanently7377700Database parameter is not escaped
#3199Comment Edit Core – Simple Comment Editing7327852k+Non-prefixed hook name
#3200TOCHAT.BE73271800Request data is not unslashed