PluginScore

WordPress.DB.DirectDatabaseQuery.SchemaChange

Schema Change

The plugin runs a direct database query instead of using a higher-level WordPress API or cache-aware pattern.

medium weight

Why It Shows Up

Plugin Check found `$wpdb` access that queries the database directly, changes schema, or bypasses normal caching expectations.

Why It Matters

Direct queries can be correct, but they are easier to make unsafe, slower at scale, and harder for WordPress to cache or filter.

How to Fix

  • Use WordPress APIs such as post, term, metadata, option, or user functions when they fit the task.
  • If direct SQL is necessary, prepare dynamic values and add a clear caching strategy for repeated reads.
  • Keep schema changes in activation or upgrade routines and make them idempotent.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#101Events Manager – Calendar, Bookings, Tickets, and more!224,7225,62170k+Output is not escaped
#102FireBox Popups – Increase Sales and Grow Your Email List221538127k+Non-prefixed global variable
#103Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder22409236700k+Text Domain Mismatch
#104Notification Bar, Announcement and Cookie Notice WordPress Plugin – FooBar221,3211,3713k+Non-prefixed global variable
#105GeoDirectory – WP Business Directory Plugin and Classified Listings Directory224,4663,97210k+Output is not escaped
#106HeadSpace2 SEO229403603k+Text Domain Mismatch
#107Hesabfa Accounting22467718400Text Domain Mismatch
#108History Log by click5226751,290400Direct Query
#109IMPress for IDX Broker221,0856367k+Text Domain Mismatch
#110Insert or Embed Articulate Content into WordPress226591,4372k+Non-prefixed global variable
#111The Innovative Form Builder – IvyForms22713250400Exception output is not escaped
#112InfiniteWP Client222,2861,812200k+Exception output is not escaped
#113Import WP – Export and Import CSV and XML files to WordPress225803304k+Exception output is not escaped
#114LearnPress – WordPress LMS Plugin for Create and Sell Online Courses222,3463,34170k+Non-prefixed global variable
#115Leyka222533,4452k+Request data is not unslashed
#116Custom Login Page Customizer – Login Designer225881,45530k+Non-prefixed global variable
#117Mail Baby SMTP22385699600SQL query is not prepared
#118MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.222,6192,45310k+Output is not escaped
#119Modula Image Gallery – Photo Grid & Video Gallery22474436100k+Text Domain Mismatch
#120Moloni229023562k+Missing Arg Domain
#121Newsletters222,9682,2482k+Text Domain Mismatch
#122WP OAuth Server (OAuth Authentication)221893473k+Non-prefixed function
#123PagBank / PagSeguro Connect para WooCommerce225047434k+Non-prefixed global variable
#124PAYCOMET for WooCommerce221,2064232k+Text Domain Mismatch
#125Smart Popup by Supsystic223,17250310k+Non Singular String Literal Domain
#126Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App221,5812,326300k+Non-prefixed global variable
#127Prime Mover – Migrate WordPress Website & Backups221,3261,60010k+Non-prefixed global variable
#128Pronamic Pay222581,0772k+Non-prefixed global variable
#129PageSpeed Ninja – Cache, Minify, Defer CSS JavaScript, Critical CSS, Optimize Images, Convert WebP229844075k+Unsafe printing function
#130Restrict User Access – Ultimate Membership & Content Protection229771,84010k+Non-prefixed global variable
#131Salon Booking System – Free Version226556202k+Missing direct file access protection
#132Seraphinite Accelerator2259425550k+Output is not escaped
#133SSL Zen — SSL Certificate Installer & HTTPS Redirects227791,57510k+Non-prefixed global variable
#134SVG Flags – Beautiful Scalable Flags For All Countries!227551,2512k+Non-prefixed global variable
#135Swift Performance Lite222,3461,3257k+Text Domain Mismatch
#136Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent222255198k+error log error log
#137Ultimate Carousel For Divi225901,566800Non-prefixed global variable
#138Ultimeter227511,3441k+Non-prefixed global variable
#139Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin225302,33440k+Direct Query
#140Unlimited Elements Blocks Library227081,822400Non-prefixed global variable
#141RapidLoad AI – Optimize Web Vitals Automatically2281840800Nonce verification recommended
#142Search & Replace Everything – Quick and Easy Way to Find and Replace Text, Links221,0441,79720k+Non-prefixed global variable
#143URL Shortify – Simple and Easy URL Shortener221,5202,68910k+Non-prefixed global variable
#144Welcart e-Commerce2210,37710,89610k+Text Domain Mismatch
#145UserFeedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds22444243200k+Text Domain Mismatch
#146Walker Core221,3511,436800Non-prefixed global variable
#147Fraud Prevention For WooCommerce and EDD225721,3945k+Non-prefixed global variable
#148WooCommerce221,3596,1717m+Non-prefixed global variable
#149Advanced AJAX Product Filters222,6831,20550k+Text Domain Mismatch
#150WP Affiliate Disclosure221,3581,5041k+Non-prefixed global variable