WordPress.DB.DirectDatabaseQuery.DirectQuery
Direct Query
The plugin runs a direct database query instead of using a higher-level WordPress API or cache-aware pattern.
Why It Shows Up
Plugin Check found `$wpdb` access that queries the database directly, changes schema, or bypasses normal caching expectations.
Why It Matters
Direct queries can be correct, but they are easier to make unsafe, slower at scale, and harder for WordPress to cache or filter.
How to Fix
- Use WordPress APIs such as post, term, metadata, option, or user functions when they fit the task.
- If direct SQL is necessary, prepare dynamic values and add a clear caching strategy for repeated reads.
- Keep schema changes in activation or upgrade routines and make them idempotent.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #3251 | Internet Archive Wayback Machine Link Fixer | 77 | 2 | 22 | 1k+ | Database parameter is not escaped | ||
| #3252 | Photo & Video Gallery – Image, Video & Portfolio | 77 | 4 | 10 | 1k+ | Missing Version | ||
| #3253 | Posts List | 77 | 11 | 15 | 7k+ | Non-prefixed hook name | ||
| #3254 | SureRank SEO – Smart Assistant with Meta Tags, Social Preview, XML Sitemap, and Schema | 77 | 58 | 95 | 300k+ | Non-prefixed hook name | ||
| #3255 | Table Of Contents Block | 77 | 15 | 8 | 10k+ | wp function not compatible with requires wp | ||
| #3256 | Tagembed Social Feeds Widget | 77 | 21 | 137 | 10k+ | Non-prefixed function | ||
| #3257 | Taggbox – Free Social Media Widgets, Review Badges & Shoppable UGC | 77 | 23 | 113 | 1k+ | Direct Query | ||
| #3258 | Unattach | 77 | 4 | 11 | 900 | Nonce verification recommended | ||
| #3259 | Username | 77 | 5 | 8 | 700 | Deprecated function: screen_icon | ||
| #3260 | WP Comment Notification | 77 | 28 | 10 | 400 | Missing Arg Domain | ||
| #3261 | X-Currency – The Ultimate WooCommerce currency switcher for a smoother shopping experience | 77 | 17 | 77 | 1k+ | Non-prefixed global variable | ||
| #3262 | Claspo – Popups, Spin the Wheel & Email Capture | 78 | 107 | 16 | 1k+ | wp function not compatible with requires wp | ||
| #3263 | Web3 Crypto Payments by DePay for WooCommerce | 78 | 6 | 101 | 1k+ | Direct Query | ||
| #3264 | Image Alt Text | 78 | 5 | 19 | 9k+ | Nonce verification recommended | ||
| #3265 | Recent Posts | 78 | 7 | 2 | 400 | Database parameter is not escaped | ||
| #3266 | RSS Includes Pages | 78 | 4 | 8 | 10k+ | Output is not escaped | ||
| #3267 | SearchWP Live Ajax Search | 78 | 8 | 23 | 50k+ | Non-prefixed global variable | ||
| #3268 | WooCommerce Square | 78 | 6 | 266 | 80k+ | Non-prefixed hook name | ||
| #3269 | Auto Featured Image (Auto Post Thumbnail) | 79 | 5 | 30 | 50k+ | Non-prefixed hook name | ||
| #3270 | Boxzilla – WordPress Popup Builder | 79 | 4 | 64 | 20k+ | Non-prefixed global variable | ||
| #3271 | Klaviyo | 79 | 26 | 86 | 100k+ | Non-prefixed function | ||
| #3272 | Location Weather – WordPress Weather Forecast, Air Quality & Weather Widget | 79 | 567 | 10k+ | Non-prefixed global variable | |||
| #3273 | Real Category Management: Content Management in Category Folders | 79 | 4 | 73 | 2k+ | Non-prefixed constant | ||
| #3274 | Related Products Manager for WooCommerce | 79 | 9 | 43 | 1k+ | Non-prefixed global variable | ||
| #3275 | Notifima – WooCommerce Stock Manager, Inventory Management, Waitlist | 79 | 121 | 42 | 3k+ | Text Domain Mismatch | ||
| #3276 | WP Last Modified Info | 79 | 45 | 32 | 40k+ | Short PHP open tag found | ||
| #3277 | WP Referral Code | 79 | 18 | 19 | 600 | Missing direct file access protection | ||
| #3278 | Antispam Bee | 80 | 4 | 38 | 700k+ | Nonce verification recommended | ||
| #3279 | ShopEngine Gutenberg WooCommerce Builder Blocks Addon – All in One WooCommerce Solution | 80 | 424 | 735 | 3k+ | Non-prefixed global variable | ||
| #3280 | Eli's PHP Compatibility Scanner | 80 | 1 | 22 | 400 | Missing nonce verification | ||
| #3281 | Flipbox | 80 | 14 | 17 | 2k+ | wp function not compatible with requires wp | ||
| #3282 | Ailo – AI Slug Translator | 80 | 8 | 14 | 1k+ | wp function not compatible with requires wp | ||
| #3283 | Media Library File Size | 80 | 3 | 15 | 6k+ | Nonce verification recommended | ||
| #3284 | Pro Mime Types – Manage file media types | 80 | 55 | 98 | 2k+ | Non-prefixed global variable | ||
| #3285 | Random Content | 80 | 10 | 8 | 3k+ | Output is not escaped | ||
| #3286 | SureMail – SMTP and Email Logs Plugin with Amazon SES, Postmark, and Other Providers | 80 | 45 | 65 | 200k+ | Non-prefixed hook name | ||
| #3287 | Product Feed PRO for WooCommerce by AdTribes – Product Feeds for WooCommerce | 80 | 9 | 450 | 80k+ | Non-prefixed hook name | ||
| #3288 | GoCardless for WooCommerce | 80 | 60 | 1k+ | Non-prefixed class | |||
| #3289 | Discounts Per Payment Method on WooCommerce | 80 | 8 | 8 | 1k+ | Missing Translators Comment | ||
| #3290 | WP Social Ninja – Embed Social Feeds, User Reviews & Chat Widgets | 80 | 26 | 18 | 30k+ | Missing direct file access protection | ||
| #3291 | Change Permalink Helper | 81 | 5 | 5 | 900 | Direct Query | ||
| #3292 | Countdown Block | 81 | 14 | 10 | 4k+ | wp function not compatible with requires wp | ||
| #3293 | Joinchat – Enhanced "click to chat" | 81 | 17 | 32 | 700k+ | wp function not compatible with requires wp | ||
| #3294 | eCommerce Shipping Dashboard by UPS for WooCommerce | 81 | 6 | 35 | 1k+ | Non-prefixed constant | ||
| #3295 | LoftLoader | 81 | 17 | 19 | 70k+ | Missing direct file access protection | ||
| #3296 | OG — Better Share on Social Media | 81 | 14 | 51 | 30k+ | Non-prefixed hook name | ||
| #3297 | Price Table Block | 81 | 15 | 16 | 900 | file system operations mkdir | ||
| #3298 | Progress Bars | 81 | 15 | 14 | 500 | file system operations mkdir | ||
| #3299 | Orphans | 81 | 1 | 43 | 50k+ | Dynamic hook name | ||
| #3300 | Stream | 81 | 5 | 80 | 80k+ | Direct Query |
