PluginScore

WordPress.DB.DirectDatabaseQuery.SchemaChange

Schema Change

The plugin runs a direct database query instead of using a higher-level WordPress API or cache-aware pattern.

medium weight

Why It Shows Up

Plugin Check found `$wpdb` access that queries the database directly, changes schema, or bypasses normal caching expectations.

Why It Matters

Direct queries can be correct, but they are easier to make unsafe, slower at scale, and harder for WordPress to cache or filter.

How to Fix

  • Use WordPress APIs such as post, term, metadata, option, or user functions when they fit the task.
  • If direct SQL is necessary, prepare dynamic values and add a clear caching strategy for repeated reads.
  • Keep schema changes in activation or upgrade routines and make them idempotent.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#51Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More21522,063300k+Non-prefixed global variable
#52Frontend Dashboard21384945500Non-prefixed function
#53Imagify Image Optimization: Optimize Images | Compress & Convert to WebP/AVIF214288621m+Non-prefixed global variable
#54Leyka212573,4462k+Request data is not unslashed
#55Mapster WP Maps213,4402,8943k+Text Domain Mismatch
#56Mooberry Book Manager211,0403991k+Text Domain Mismatch
#57MotoPress Hotel Booking213,0671,03710k+Text Domain Mismatch
#58Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred211,4783,33710k+Non-prefixed global variable
#59Oasis Workflow21775575600Text Domain Mismatch
#60Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction211,9535,29710k+Non-prefixed hook name
#61User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor217031,46340k+Missing Translators Comment
#62Quill Forms | Conversational Multi Step Forms, Surveys & quizzes214013703k+Text Domain Mismatch
#63Rocket Maintenance Mode & Coming Soon Page211,1761,4064k+Non-prefixed global variable
#64Royal Addons for Elementor – Addons and Templates Kit for Elementor2113,0162,440600k+Text Domain Mismatch
#65Trace My IP – Visitor IP Tracker, Stats Analytics & Page Views Counter with Email Alerts218713381k+wp function not compatible with requires wp
#66Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin211,0742,97840k+Direct Query
#67URL Shortify – Simple and Easy URL Shortener211,5112,66910k+Non-prefixed global variable
#68Buckaroo Woocommerce Payments Plugin216383212k+Exception output is not escaped
#69BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages216681,569800Non-prefixed global variable
#70Wise Chat214705065k+Output is not escaped
#71WooCommerce211,3436,2127m+Non-prefixed global variable
#72Pay For Post with WooCommerce219581,4771k+Non-prefixed global variable
#73Wordfence Security – Firewall, Malware Scan, and Login Security211,5922,9735m+Output is not escaped
#74WP Compress – Instant Performance & Speed Optimization213,3673,25310k+Non Singular String Literal Domain
#75WP-Lister Lite for eBay216,7015,1322k+Output is not escaped
#76wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin211,8121,43270k+Output is not escaped
#77WP Extended – The Ultimate WordPress Toolkit211,253398600Non Singular String Literal Domain
#78WebTotem Security211,110213800Text Domain Mismatch
#79WP Sessions Time Monitoring Full Automatic228691,529500Non-prefixed global variable
#80Advanced Classifieds & Directory Pro221,2293,5122k+Non-prefixed global variable
#81Ajax Load More – Infinite Scroll, Load More, & Lazy Load2264159230k+Unsafe printing function
#82All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos229122,88520k+Non-prefixed global variable
#83Backup Bolt225801,313800Non-prefixed global variable
#84Knowledge Base documentation & wiki plugin – BasePress Docs226711,7672k+Non-prefixed global variable
#85Captcha by BestWebSoft – Advanced Spam Protection, Math & OCR-Friendly Captcha for Site Forms2249329510k+Text Domain Mismatch
#86Cart Lift – Abandoned Cart Recovery for WooCommerce and EDD226697691k+Output is not escaped
#87Cleanup Action Scheduler225451,3061k+Non-prefixed global variable
#88Passster – Password Protect Pages and Content225391,42210k+Non-prefixed global variable
#89Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates222,3924,2906k+Non-prefixed global variable
#90RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login223,6525,1348k+Non-prefixed global variable
#91Data Tables Generator by Supsystic2216419810k+Exception output is not escaped
#92Directorist: AI-Powered Business Directory, Listings & Classified Ads225602,20220k+Non-prefixed global variable
#93DirectoryPress – Business Directory And Classified Ad Listing224,7872,795700Text Domain Mismatch
#94Download Manager222,5131,459100k+Output is not escaped
#95E2Pdf – Export Pdf Tool for WordPress221,08184710k+Unsafe printing function
#96easyReservations225,3072,480800Text Domain Mismatch
#97EleSpare – News, Magazine and Blog Addons for Elementor227331,42310k+Non-prefixed global variable
#98Estatik Real Estate Plugin223,08432510k+Text Domain Mismatch
#99Events Manager – Calendar, Bookings, Tickets, and more!224,7165,69070k+Output is not escaped
#100FACTO – Facturación Electrónica22244423400Request data is not unslashed