PluginScore

WordPress.DB.DirectDatabaseQuery.SchemaChange

Schema Change

The plugin runs a direct database query instead of using a higher-level WordPress API or cache-aware pattern.

medium weight

Why It Shows Up

Plugin Check found `$wpdb` access that queries the database directly, changes schema, or bypasses normal caching expectations.

Why It Matters

Direct queries can be correct, but they are easier to make unsafe, slower at scale, and harder for WordPress to cache or filter.

How to Fix

  • Use WordPress APIs such as post, term, metadata, option, or user functions when they fit the task.
  • If direct SQL is necessary, prepare dynamic values and add a clear caching strategy for repeated reads.
  • Keep schema changes in activation or upgrade routines and make them idempotent.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#601Tax Exemption for WooCommerce255521,402700Non-prefixed global variable
#602TemplateSpare – 1000+ WordPress Starter Templates & Full Site Migration Tool | 1-Click Import/Export & No-Code Builder257051,58710k+Non-prefixed global variable
#603Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin251192,7042k+Non-prefixed global variable
#604TrackShip for WooCommerce254219576k+Non-prefixed global variable
#605TrueBooker – Appointment Booking and Scheduler System255292,746600Non-prefixed global variable
#606Ultimate Blocks – 25+ Gutenberg Blocks for Block Editor256911,58150k+Non-prefixed global variable
#6073D viewer by Visody258321,3221k+Non-prefixed global variable
#608WC Disable Zoom / Lightbox features255291,297700Non-prefixed global variable
#609Product Customer List for WooCommerce256101,3349k+Non-prefixed global variable
#610Advanced Shipment Tracking for WooCommerce2549970460k+Non-prefixed global variable
#611Secure Gateway for Authorize.net and WooCommerce by Pledged Plugins259071,41810k+Non-prefixed global variable
#612Digital Goods (Checkout Field Editor) for WooCommerce Checkout255391,4793k+Non-prefixed global variable
#613Dynamic Pricing and Discount Rules for WooCommerce255311,569600Non-prefixed global variable
#614Flat Rate Shipping Method for WooCommerce251,2421,7785k+Non-prefixed global variable
#615HUSKY – Products Filter Professional for WooCommerce251,89590k+Non-prefixed global variable
#616Wordfence Login Security2524841870k+Output is not escaped
#617WP Airbnb Review Slider253256461k+Non-prefixed global variable
#618Super Page Cache – Cloudflare Cache, Page Speed & Core Web Vitals2513735360k+Input is not sanitized
#619WP Coupons and Deals – WordPress Coupon Plugin259141,4601k+Non-prefixed global variable
#620WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards251,4311,27010k+Output is not escaped
#621WP-DownloadManager256075083k+Unsafe printing function
#622Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered)252,6522,09110k+Text Domain Mismatch
#623WP Review Slider251,1862,2796k+Non-prefixed global variable
#624WP Go Maps – Google Map, OpenStreetMap, Leaflet Map254,9961,008300k+Unsafe printing function
#625WP Google Review Slider251,3672,58430k+Non-prefixed global variable
#626WP Encryption – No.1 HTTPS plugin & One Click Free SSL Cert, HTTPS Redirect, Security257271,55450k+Non-prefixed global variable
#627WP Photo Album Plus2541,80710k+Direct Query
#628WP-Polls2561863940k+Unsafe printing function
#629SlimStat Analytics251,17787070k+Exception output is not escaped
#630Smush – Image Optimization, Compression, Lazy Load, WebP & CDN252445681m+Non-prefixed hook name
#631WP Spell Check254,4252k+Direct Query
#632WP Statistics – Simple, privacy-friendly Google Analytics alternative256102,465600k+Non-prefixed global variable
#633WP Time Slots Booking Form254391,1371k+Non-prefixed global variable
#634WP TripAdvisor Review Slider251,0532,5778k+Non-prefixed global variable
#635WP Yelp Review Slider254296451k+Non-prefixed global variable
#636Team Members Showcase255911,4944k+Non-prefixed global variable
#637WPvivid — Backup, Migration & Staging259001,461900k+Non-prefixed namespace
#638YT Player – Embed and Customize Video Players253,1632611k+Output is not escaped
#639AI Content Writing Assistant261,069516700Text Domain Mismatch
#640Bangladeshi Payments Mobile – QR Code & Transaction Reports265351,2801k+Non-prefixed global variable
#641Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty26113671400k+Non-prefixed global variable
#642Conditional Logic for Woo Product Add-ons265751,352500Non-prefixed global variable
#643Database for Contact Form 7, WPforms, Elementor forms2631748960k+Non-prefixed global variable
#644CP Multi View Events Calendar2686439900Non-prefixed global variable
#645Ditty – Responsive News Tickers, Sliders, and Lists2656148430k+Output is not escaped
#646Easy Post Views Count265341,1802k+Non-prefixed global variable
#647ezCache2612728810k+Direct Query
#648RSS Redirect & Feedburner Alternative262772721k+Output is not escaped
#649FG Drupal to WordPress26275100700Unsafe printing function
#650Hide Admin Bar Based on User Roles265491,34520k+Non-prefixed global variable