PluginScore

WordPress.DB.DirectDatabaseQuery.SchemaChange

Schema Change

The plugin runs a direct database query instead of using a higher-level WordPress API or cache-aware pattern.

medium weight

Why It Shows Up

Plugin Check found `$wpdb` access that queries the database directly, changes schema, or bypasses normal caching expectations.

Why It Matters

Direct queries can be correct, but they are easier to make unsafe, slower at scale, and harder for WordPress to cache or filter.

How to Fix

  • Use WordPress APIs such as post, term, metadata, option, or user functions when they fit the task.
  • If direct SQL is necessary, prepare dynamic values and add a clear caching strategy for repeated reads.
  • Keep schema changes in activation or upgrade routines and make them idempotent.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#501Booking Calendar Contact Form25371884500Input is not validated
#502Booking Package251,7033,97710k+Missing nonce verification
#503Bookit — Booking & Appointment Calendar255651,4584k+Non-prefixed global variable
#504Online Scheduling and Appointment Booking System – Bookly253,52887060k+Text Domain Mismatch
#505Broken Link Checker25727600500k+Output is not escaped
#506SilentShield – Captcha & Anti-Spam for WordPress (CF7, WPForms, Elementor, WooCommerce)2523521410k+Database parameter is not escaped
#507GSheetConnector for CF7 – Connect Contact Form 7 to Google Sheets and Send Form Submissions in Real Time256141,43140k+Non-prefixed global variable
#508CheckView – Form & Checkout Testing25663371k+Direct Query
#509Coinbase Business Gateway for WooCommerce255691,317800Non-prefixed global variable
#510Conditional Payment Methods for WooCommerce255481,3981k+Non-prefixed global variable
#511Contact Form DB Divi255331,2993k+Non-prefixed global variable
#512Contact Form Email254098989k+Non-prefixed global variable
#513Coupon Creator256984121k+Output is not escaped
#514CP Contact Form with PayPal25466936800Unsafe printing function
#515Cryptocurrency Payment Gateway251,963589400Text Domain Mismatch
#516Smash Balloon Social Post Feed – Simple Social Feeds for WordPress25554982200k+Output is not escaped
#517Demo Importer Plus255823910k+Non-prefixed hook name
#518Show Eventbrite Events – Event Feed for Eventbrite255951,525900Non-prefixed global variable
#519Event Genius – Event Management, Events Calendar, Registration, and RSVP251811,579500Non-prefixed global variable
#520Events Made Easy255066,3171k+Non-prefixed function
#521F4 Post Tree255361,332500Non-prefixed global variable
#522胖鼠采集(Fat Rat Collect)25630190900Missing Arg Domain
#523FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler253194547k+Non-prefixed global variable
#524Lightbox & Modal Popup WordPress Plugin – FooBox256101,365100k+Non-prefixed global variable
#525Photo Gallery by FooGallery : Responsive Image Gallery, Masonry Gallery & Carousel258761,798100k+Non-prefixed global variable
#526AnWP Football Leagues253,5981,955900Text Domain Mismatch
#527Form Vibes – Save Contact Form 7 & Elementor Form Entries to Database257161,50910k+Non-prefixed global variable
#528Photo Gallery by Ays – Responsive Image Gallery254668201k+Output is not escaped
#529GD Rating System251,5111,0431k+Output is not escaped
#530GD Security Headers254075211k+Output is not escaped
#531GeekyBot — AI Copilot, Chatbot, WooCommerce Lead Gen & Zero-Prompt Content25888636k+Non-prefixed global variable
#532Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported)25501,0431k+Non-prefixed global variable
#533Simple Giveaways – Grow your business, email lists and traffic with contests259562,384400Non-prefixed global variable
#534WPBruiser {no- Captcha anti-Spam}2564625910k+Non Singular String Literal Domain
#535MonsterInsights – Google Analytics Dashboard for WordPress (Website Stats Made Easy)251164412m+Nonce verification recommended
#536Logo Slider – Logo Showcase, Logo Carousel, Logo Gallery and Client Logo Presentation2578931330k+Text Domain Mismatch
#537Team Members – A WordPress Team Plugin with Gallery, Grid, Carousel, Slider, Table, List, and More251,7862,2202k+Non-prefixed global variable
#538Solid Testimonials – Testimonial Slider, Video Testimonials & Customer Reviews256451,5851k+Non-prefixed global variable
#539HashBar – Announcement, Notification Bar & Popup Campaign252,7186108k+Text Domain Mismatch
#540Cool Author Box – For Widget and Post Content258531,379600Non-prefixed global variable
#541HT Contact Form – Drag & Drop Form Builder for WordPress2516059410k+Non-prefixed global variable
#542Hydra Booking — Appointment Scheduling & Booking Calendar252356992k+Non-prefixed global variable
#543Independent Analytics – WordPress Analytics Plugin251,1482,293100k+Non-prefixed global variable
#544Index WP MySQL For Speed2525025550k+Output is not escaped
#545Smash Balloon Social Photo Feed – Easy Social Feeds Plugin254491,3001m+Interpolated SQL is not prepared
#546IP Location Block2552162410k+Output is not escaped
#547JobWP – Job Board, Job Listing, Career Page and Recruitment Plugin251,5411,5781k+Non-prefixed global variable
#548JoomSport – for Sports: Team & League, Football, Hockey & more255231,7471k+Direct Query
#549kk Star Ratings – Rate Post & Collect User Feedbacks257721,38870k+Non-prefixed global variable
#550Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more254,0191,2652k+Text Domain Mismatch