PluginScore

WordPress.DB.DirectDatabaseQuery.SchemaChange

Schema Change

The plugin runs a direct database query instead of using a higher-level WordPress API or cache-aware pattern.

medium weight

Why It Shows Up

Plugin Check found `$wpdb` access that queries the database directly, changes schema, or bypasses normal caching expectations.

Why It Matters

Direct queries can be correct, but they are easier to make unsafe, slower at scale, and harder for WordPress to cache or filter.

How to Fix

  • Use WordPress APIs such as post, term, metadata, option, or user functions when they fit the task.
  • If direct SQL is necessary, prepare dynamic values and add a clear caching strategy for repeated reads.
  • Keep schema changes in activation or upgrade routines and make them idempotent.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#701wp-mpdf271233821k+Non-prefixed global variable
#702YARPP – Yet Another Related Posts Plugin27191331100k+Non-prefixed global variable
#703Zibal Payment Gateway for Gravity Forms27828248400Text Domain Mismatch
#704Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms28632351800Text Domain Mismatch
#705Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms286493579k+Text Domain Mismatch
#706WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms28659359400Text Domain Mismatch
#707Contact Form by BestWebSoft – Advanced WP Contact Form Builder for WordPress2846533830k+Text Domain Mismatch
#708Maspik – Ultimate Spam Protection2821286230k+Missing nonce verification
#709Database Cleaner2813729710k+Direct Query
#710Educare – Students & Result Management System281,1141,043800Missing nonce verification
#711Geo Mashup287752321k+Text Domain Mismatch
#712Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms286413481k+Text Domain Mismatch
#713Media Hygiene: Remove or Delete Unused Images and More!286543095k+Non Singular String Literal Domain
#714My Sticky Bar – Floating Notification Bar & Sticky Header (formerly myStickymenu)28164441100k+Non-prefixed global variable
#715ووکامرس فارسی2815721590k+Output is not escaped
#716Rating by BestWebSoft28509218400Text Domain Mismatch
#717ReDi Restaurant Reservation – Instant Restaurant Booking & Table Reservation System281,013239800Unsafe printing function
#718Transliterator – Multilingual and Multi-script Text Conversion283053223k+Output is not escaped
#719Slider Pro285835274k+Unsafe printing function
#720Tab – Accordion, FAQ281045421k+Non-prefixed global variable
#721Terms descriptions282224231k+Non-prefixed function
#722Jetpack VaultPress287136210k+Missing nonce verification
#723WP ADA Compliance Check Basic287851773k+Text Domain Mismatch
#724WP Booking System – Booking Calendar2850254920k+Output is not escaped
#725WhyDonate – FREE Donate button – Crowdfunding – Fundraising28216328800Non-prefixed global variable
#726WP Synchro – The Ultimate WordPress Migration Tool282432442k+Missing Translators Comment
#727Accordion Slider293914472k+Unsafe printing function
#728AL Pack29138162k+Non-prefixed global variable
#729Alt Text AI – Automatically generate image alt text for SEO and accessibility297228020k+Non-prefixed global variable
#730Attribute Stock for WooCommerce – Shared Stock & Variable Quantities (Lite Version)294813132k+Text Domain Mismatch
#731Bitcoin Payments – Blockonomics292082272k+Output is not escaped
#732Plugin BlueX for WooCommerce294312162k+Text Domain Mismatch
#733Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms292363692k+Non-prefixed global variable
#734Chained Quiz291,1327211k+Text Domain Mismatch
#735CloudSecure WP Security2974350100k+Request data is not unslashed
#736FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider297478600k+Missing Translators Comment
#737Gianism29391154700Text Domain Mismatch
#738reCaptcha by BestWebSoft29474272100k+Text Domain Mismatch
#739Integration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms296253511k+Text Domain Mismatch
#740miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn)299289810k+Request data is not unslashed
#741Offload Media – Cloud Storage29126801k+unlink unlink
#742Page View Count2910624610k+Dynamic hook name
#743Post Views Counter29179398200k+Non-prefixed hook name
#744Security Ninja – WordPress Security & Firewall291493477k+Direct Query
#745Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce291482465k+Unsafe printing function
#746Shiptastic for WooCommerce2915466210k+Non-prefixed global variable
#747Slider by BestWebSoft29478336400Text Domain Mismatch
#748Widget for Yelp Reviews291471582k+Output is not escaped
#749WP-PostRatings2942538430k+Output is not escaped
#750Xagio SEO – AI Powered SEO2921,27310k+Direct Query