WordPress.DB.DirectDatabaseQuery.SchemaChange

Schema Change

The plugin runs a direct database query instead of using a higher-level WordPress API or cache-aware pattern.

medium weight

Why It Shows Up

Plugin Check found `$wpdb` access that queries the database directly, changes schema, or bypasses normal caching expectations.

Why It Matters

Direct queries can be correct, but they are easier to make unsafe, slower at scale, and harder for WordPress to cache or filter.

How to Fix

  • Use WordPress APIs such as post, term, metadata, option, or user functions when they fit the task.
  • If direct SQL is necessary, prepare dynamic values and add a clear caching strategy for repeated reads.
  • Keep schema changes in activation or upgrade routines and make them idempotent.

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#51Wise Chat214705065k+Output is not escaped
#52WooCommerce211,3596,1727m+Non-prefixed global variable
#53Pay For Post with WooCommerce219601,4741k+Non-prefixed global variable
#54Wordfence Security – Firewall, Malware Scan, and Login Security211,5922,9735m+Output is not escaped
#55WP-Lister Lite for eBay216,6975,1292k+Output is not escaped
#56wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin211,8111,43270k+Output is not escaped
#57Premium Packages – Sell Digital Products Securely212,7652,4443k+Output is not escaped
#58Frontend Admin by DynamiApps225,9223,20810k+Text Domain Mismatch
#59Advanced Classifieds & Directory Pro221,2293,5112k+Non-prefixed global variable
#60Advanced Form Integration — Connect Forms to 200+ Apps225,7714,67810k+wp function not compatible with requires wp
#61Ajax Load More – Infinite Scroll, Load More, & Lazy Load2264159540k+Unsafe printing function
#62All-in-One Video Gallery229112,89220k+Non-prefixed global variable
#63Booking for Appointments and Events Calendar – Amelia221,48948090k+Exception output is not escaped
#64Knowledge Base documentation & wiki plugin – BasePress Docs226711,7672k+Non-prefixed global variable
#65Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots221,6042,01910k+Direct Query
#66BuddyPress225839,008100k+Non-prefixed function
#67Captcha by BestWebSoft – Advanced Spam Protection, Math & OCR-Friendly Captcha for Site Forms2249329510k+Text Domain Mismatch
#68Divi Carousel Lite – 17+ Carousel Module229671,27510k+Non-prefixed global variable
#69Cart Lift – Abandoned Cart Recovery for WooCommerce and EDD226697691k+Output is not escaped
#70Cleanup Action Scheduler225451,3061k+Non-prefixed global variable
#71Passster – Password Protect Pages and Content225391,41910k+Non-prefixed global variable
#72Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 500+ Patterns, 57 Blocks & Templates222,1674,1757k+Non-prefixed global variable
#73RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login223,6545,0618k+Non-prefixed global variable
#74Data Tables Generator by Supsystic2215715010k+Exception output is not escaped
#75Directorist: AI-Powered Business Directory, Listings & Classified Ads224432,12920k+Non-prefixed global variable
#76Download Manager222,2901,301100k+Output is not escaped
#77E2Pdf – Export Pdf Tool for WordPress221,07583610k+Unsafe printing function
#78EleSpare – News, Magazine and Blog Addons for Elementor227331,42310k+Non-prefixed global variable
#79Estatik Real Estate Plugin223,04932510k+Text Domain Mismatch
#80Events Manager – Calendar, Bookings, Tickets, and more!224,7225,62170k+Output is not escaped
#81FireBox Popups – Increase Sales and Grow Your Email List221538127k+Non-prefixed global variable
#82Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder22409236700k+Text Domain Mismatch
#83Notification Bar, Announcement and Cookie Notice WordPress Plugin – FooBar221,3211,3713k+Non-prefixed global variable
#84GeoDirectory – WP Business Directory Plugin and Classified Listings Directory224,4663,97210k+Output is not escaped
#85Anti-Malware Security and Brute-Force Firewall22544965100k+Output is not escaped
#86HeadSpace2 SEO229403603k+Text Domain Mismatch
#87IMPress for IDX Broker221,0856367k+Text Domain Mismatch
#88Insert or Embed Articulate Content into WordPress226591,4372k+Non-prefixed global variable
#89InfiniteWP Client222,2861,812200k+Exception output is not escaped
#90Import WP – Export and Import CSV and XML files to WordPress225803304k+Exception output is not escaped
#91LearnPress – WordPress LMS Plugin for Create and Sell Online Courses222,3613,38470k+Non-prefixed global variable
#92Leyka222533,4452k+Request data is not unslashed
#93Custom Login Page Customizer – Login Designer225881,45530k+Non-prefixed global variable
#94MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.222,6192,45310k+Output is not escaped
#95Modula Image Gallery – Photo Grid & Video Gallery22474436100k+Text Domain Mismatch
#96Moloni229023562k+Missing Arg Domain
#97Newsletters222,9682,2482k+Text Domain Mismatch
#98WP OAuth Server (OAuth Authentication)221893473k+Non-prefixed function
#99PagBank / PagSeguro Connect para WooCommerce225047434k+Non-prefixed global variable
#100PAYCOMET for WooCommerce221,2064232k+Text Domain Mismatch