PluginScore

WordPress.DB.DirectDatabaseQuery.SchemaChange

Schema Change

The plugin runs a direct database query instead of using a higher-level WordPress API or cache-aware pattern.

medium weight

Why It Shows Up

Plugin Check found `$wpdb` access that queries the database directly, changes schema, or bypasses normal caching expectations.

Why It Matters

Direct queries can be correct, but they are easier to make unsafe, slower at scale, and harder for WordPress to cache or filter.

How to Fix

  • Use WordPress APIs such as post, term, metadata, option, or user functions when they fit the task.
  • If direct SQL is necessary, prepare dynamic values and add a clear caching strategy for repeated reads.
  • Keep schema changes in activation or upgrade routines and make them idempotent.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#1BulletProof Security05,0484,94920k+Output is not escaped
#2Plugin Check (PCP)012813210k+Exception output is not escaped
#3MDTF – Meta Data and Taxonomies Filter161,5501,9561k+Non-prefixed global variable
#4AnyComment174454495k+Output is not escaped
#5Dynamic Team Manager – Team Member Showcase with grid, slider, table Elementor widget & shortcode179222,014900Non-prefixed global variable
#6Podlove Podcast Publisher182,3541,4333k+Output is not escaped
#7Shopping Cart & eCommerce Store185,37317,4663k+Non-prefixed global variable
#8WPPizza – A Restaurant Plugin184,6892,7031k+Text Domain Mismatch
#9Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons1910,340360100k+Text Domain Mismatch
#10Block Slider – Responsive Image Slider, Video Slider & Post Slider195551,2913k+Non-prefixed global variable
#11Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution191,218901100k+Exception output is not escaped
#12Go Fetch Jobs (for WP Job Manager)191,4101,741600Non-prefixed global variable
#13Verified Reviews (Avis Vérifiés)196711,136700Non-prefixed global variable
#14Membership Plugin – Kadence Memberships195,0832,9829k+Text Domain Mismatch
#15Scrollsequence – Cinematic Scroll Image Animation Plugin198781,5284k+Non-prefixed global variable
#16SendPress Newsletters192,2931,4221k+Output is not escaped
#17SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments195331,14980k+Non-prefixed global variable
#18WP Email Template193443452k+Exception output is not escaped
#19WP Import Export Lite1973797940k+Non-prefixed global variable
#20WP Directory Kit191,5042,6382k+Non-prefixed global variable
#21AweBooking – Hotel Booking System203095141k+Non-prefixed global variable
#22Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC)207362,112900Non-prefixed global variable
#23Download Monitor204231,36480k+Non-prefixed hook name
#24Event Espresso – Event Registration & Ticketing Sales2012,6982,135600Text Domain Mismatch
#25Event Organiser201,10454420k+Text Domain Mismatch
#26GiveWP – Donation Plugin and Fundraising Platform203,4103,554100k+Output is not escaped
#27GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership201,832720700Non Singular String Literal Domain
#28Brevo – Email, SMS, Web Push, Chat, and more.20460646100k+Request data is not unslashed
#29MAS Videos205191,6931k+Non-prefixed global variable
#30Microthemer Lite – Visual Editor to Customize CSS201,0041,69910k+Non-prefixed global variable
#31Shipping for Nova Poshta20598923500Output is not escaped
#32Pix por Piggly (para Woocommerce)205471954k+Exception output is not escaped
#33Pronamic Pay202661,0782k+Non-prefixed global variable
#34Remove Add to Cart WooCommerce206161,3784k+Non-prefixed global variable
#35Robin Image Optimizer – Unlimited Image Optimization, WebP & AVIF20556543100k+Output is not escaped
#36Events Manager – OpenStreetMaps20559444700Output is not escaped
#37Razorpay for WooCommerce20975859100k+Non-prefixed function
#38Premium Packages – Sell Digital Products Securely202,0172,1832k+Non-prefixed global variable
#39Store Locator WordPress212,4941,62810k+Text Domain Mismatch
#40Backup Migration219811,09380k+Non-prefixed global variable
#41Kadence Security – Password, Two Factor Authentication, and Brute Force Protection211,060957700k+Missing Translators Comment
#42Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots211,6212,03810k+Direct Query
#43Captcha Them All213003235k+Output is not escaped
#44SMS Extension for Contact Form 7217201,387400Non-prefixed global variable
#45Daily Prayer Time219471,7801k+Non-prefixed global variable
#46DELUCKS SEO213621,171400Missing nonce verification
#47Free Downloads WooCommerce214303594k+Output is not escaped
#48Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More212,5721,2771m+Output is not escaped
#49eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams211864379k+Non-prefixed global variable
#50Feeds for YouTube (YouTube video, channel, and gallery plugin)21558978100k+Output is not escaped