PluginScore

WordPress.DB.DirectDatabaseQuery.SchemaChange

Schema Change

The plugin runs a direct database query instead of using a higher-level WordPress API or cache-aware pattern.

medium weight

Why It Shows Up

Plugin Check found `$wpdb` access that queries the database directly, changes schema, or bypasses normal caching expectations.

Why It Matters

Direct queries can be correct, but they are easier to make unsafe, slower at scale, and harder for WordPress to cache or filter.

How to Fix

  • Use WordPress APIs such as post, term, metadata, option, or user functions when they fit the task.
  • If direct SQL is necessary, prepare dynamic values and add a clear caching strategy for repeated reads.
  • Keep schema changes in activation or upgrade routines and make them idempotent.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#1BulletProof Security05,0484,94920k+Output is not escaped
#2Plugin Check (PCP)012814010k+Non-prefixed global variable
#3404 Solution155821,53210k+Non-prefixed class
#4MDTF – Meta Data and Taxonomies Filter161,5501,9561k+Non-prefixed global variable
#5AnyComment174454495k+Output is not escaped
#6Shopping Cart & eCommerce Store177,45317,8663k+Non-prefixed global variable
#7Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution181,229923100k+Exception output is not escaped
#8WPPizza – A Restaurant Plugin184,6892,7031k+Text Domain Mismatch
#9Block Slider – Responsive Image Slider, Video Slider & Post Slider195551,2913k+Non-prefixed global variable
#10GiveWP – Donation Plugin and Fundraising Platform193,4223,570100k+Output is not escaped
#11Go Fetch Jobs (for WP Job Manager)191,4101,741600Non-prefixed global variable
#12Verified Reviews (Avis Vérifiés)196711,136700Non-prefixed global variable
#13Scrollsequence – Cinematic Scroll Image Animation Plugin198781,5283k+Non-prefixed global variable
#14SendPress Newsletters192,2931,4221k+Output is not escaped
#15SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments195431,15080k+Non-prefixed global variable
#16WP Email Template193443452k+Exception output is not escaped
#17AweBooking – Hotel Booking System203095141k+Non-prefixed global variable
#18Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC)207362,112900Non-prefixed global variable
#19Download Monitor204231,36780k+Non-prefixed hook name
#20Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More202,8781,9881m+Non-prefixed global variable
#21Event Organiser201,10454420k+Text Domain Mismatch
#22GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership201,832720700Non Singular String Literal Domain
#23Brevo – Email, SMS, Web Push, Chat, and more.20460646100k+Request data is not unslashed
#24MAS Videos205191,6931k+Non-prefixed global variable
#25Microthemer Lite – Visual Editor to Customize CSS201,0041,69910k+Non-prefixed global variable
#26Shipping for Nova Poshta20598923400Output is not escaped
#27Pix por Piggly (para Woocommerce)205471954k+Exception output is not escaped
#28Pronamic Pay202661,0782k+Non-prefixed global variable
#29Remove Add to Cart WooCommerce206161,3784k+Non-prefixed global variable
#30Membership Plugin – Kadence Memberships205,0893,0059k+Text Domain Mismatch
#31Restrict User Access – Ultimate Membership & Content Protection209771,84810k+Non-prefixed global variable
#32Robin Image Optimizer – Unlimited Image Optimization, WebP & AVIF20556543100k+Output is not escaped
#33Events Manager – OpenStreetMaps20559444600Output is not escaped
#34Premium Packages – Sell Digital Products Securely202,0412,2992k+Non-prefixed global variable
#35Backup Migration219991,08180k+Non-prefixed global variable
#36Kadence Security – Password, Two Factor Authentication, and Brute Force Protection211,060959700k+Missing Translators Comment
#37Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots211,6742,18010k+Direct Query
#38Captcha Them All213003235k+Output is not escaped
#39Spam protection, Honeypot, Anti-Spam by CleanTalk218351,146200k+Missing nonce verification
#40DELUCKS SEO213621,171300Missing nonce verification
#41eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams211864378k+Non-prefixed global variable
#42Event Espresso – Event Registration & Ticketing Sales2112,7102,136600Text Domain Mismatch
#43Feeds for YouTube (YouTube video, channel, and gallery plugin)21503995100k+Output is not escaped
#44Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More21562,148300k+Non-prefixed global variable
#45King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder211,8473,90410k+Non-prefixed global variable
#46Leyka212573,4462k+Request data is not unslashed
#47Mapster WP Maps213,5943,0203k+Text Domain Mismatch
#48Mooberry Book Manager211,0403991k+Text Domain Mismatch
#49MultiParcels Shipping For WooCommerce212454264k+Request data is not unslashed
#50Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred211,4363,34510k+Non-prefixed global variable