PluginScore

WordPress.DB.DirectDatabaseQuery.SchemaChange

Schema Change

The plugin runs a direct database query instead of using a higher-level WordPress API or cache-aware pattern.

medium weight

Why It Shows Up

Plugin Check found `$wpdb` access that queries the database directly, changes schema, or bypasses normal caching expectations.

Why It Matters

Direct queries can be correct, but they are easier to make unsafe, slower at scale, and harder for WordPress to cache or filter.

How to Fix

  • Use WordPress APIs such as post, term, metadata, option, or user functions when they fit the task.
  • If direct SQL is necessary, prepare dynamic values and add a clear caching strategy for repeated reads.
  • Keep schema changes in activation or upgrade routines and make them idempotent.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#1BulletProof Security05,0484,94920k+Output is not escaped
#2Plugin Check (PCP)012813210k+Exception output is not escaped
#3MDTF – Meta Data and Taxonomies Filter161,5501,9561k+Non-prefixed global variable
#4AnyComment174454495k+Output is not escaped
#5Podlove Podcast Publisher182,3541,4333k+Output is not escaped
#6Shopping Cart & eCommerce Store185,37317,4663k+Non-prefixed global variable
#7WPPizza – A Restaurant Plugin184,6892,7031k+Text Domain Mismatch
#8Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons1910,340360100k+Text Domain Mismatch
#9Block Slider – Responsive Image Slider, Video Slider & Post Slider195551,2913k+Non-prefixed global variable
#10Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution191,218901100k+Exception output is not escaped
#11Go Fetch Jobs (for WP Job Manager)191,4101,741700Non-prefixed global variable
#12Verified Reviews (Avis Vérifiés)196711,136700Non-prefixed global variable
#13Membership Plugin – Kadence Memberships195,0822,9829k+Text Domain Mismatch
#14Scrollsequence – Cinematic Scroll Image Animation Plugin198781,5284k+Non-prefixed global variable
#15SendPress Newsletters192,2931,4221k+Output is not escaped
#16SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments195331,14980k+Non-prefixed global variable
#17WP Email Template193443452k+Exception output is not escaped
#18WP Import Export Lite1973797940k+Non-prefixed global variable
#19WP Directory Kit191,5042,6382k+Non-prefixed global variable
#20AweBooking – Hotel Booking System203095141k+Non-prefixed global variable
#21Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC)207362,112900Non-prefixed global variable
#22Download Monitor204231,36480k+Non-prefixed hook name
#23Event Espresso – Event Registration & Ticketing Sales2012,6982,135600Text Domain Mismatch
#24Event Organiser201,10454420k+Text Domain Mismatch
#25GiveWP – Donation Plugin and Fundraising Platform203,4113,559100k+Output is not escaped
#26GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership201,832720700Non Singular String Literal Domain
#27Brevo – Email, SMS, Web Push, Chat, and more.20460646100k+Request data is not unslashed
#28MAS Videos205191,6931k+Non-prefixed global variable
#29Microthemer Lite – Visual Editor to Customize CSS201,0041,69910k+Non-prefixed global variable
#30Shipping for Nova Poshta20598923500Output is not escaped
#31Pix por Piggly (para Woocommerce)205471954k+Exception output is not escaped
#32Pronamic Pay202661,0782k+Non-prefixed global variable
#33Remove Add to Cart WooCommerce206161,3784k+Non-prefixed global variable
#34Robin Image Optimizer – Unlimited Image Optimization, WebP & AVIF20556543100k+Output is not escaped
#35Events Manager – OpenStreetMaps20559444700Output is not escaped
#36Razorpay for WooCommerce20975859100k+Non-prefixed function
#37Premium Packages – Sell Digital Products Securely202,0322,1902k+Non-prefixed global variable
#38Store Locator WordPress212,4941,62810k+Text Domain Mismatch
#39Backup Migration219811,09380k+Non-prefixed global variable
#40Kadence Security – Password, Two Factor Authentication, and Brute Force Protection211,060957700k+Missing Translators Comment
#41Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots211,6212,03310k+Direct Query
#42Captcha Them All213003235k+Output is not escaped
#43SMS Extension for Contact Form 7217201,387400Non-prefixed global variable
#44Daily Prayer Time219471,7801k+Non-prefixed global variable
#45DELUCKS SEO213621,171400Missing nonce verification
#46Free Downloads WooCommerce214303594k+Output is not escaped
#47Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More212,5721,2771m+Output is not escaped
#48eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams211864379k+Non-prefixed global variable
#49Feeds for YouTube (YouTube video, channel, and gallery plugin)21558978100k+Output is not escaped
#50Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More21522,063300k+Non-prefixed global variable