PluginScore

WordPress.DB.PreparedSQL.InterpolatedNotPrepared

Interpolated SQL is not prepared

Variables are interpolated into a SQL string before the query is prepared.

critical weight

Why It Shows Up

The scan found dynamic values placed directly inside SQL, often through string interpolation, before `$wpdb->prepare()` can safely bind them.

Why It Matters

Preparing a query after unsafe interpolation does not reliably protect the dynamic value.

How to Fix

  • Replace interpolated variables with placeholders.
  • Pass each dynamic value as a separate `$wpdb->prepare()` argument.
  • Use allowlists for SQL identifiers and directions that cannot be represented as normal values.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsUpdatedTop Issue
#1BulletProof Security05,0484,94920k+Output Not Escaped
#2Themify Builder95,1952,0965k+Text Domain Mismatch
#3AnyComment174454495k+Output Not Escaped
#4JetFormBuilder — Dynamic Blocks Form Builder172,0941,58890k+Text Domain Mismatch
#5wpForo Forum174,0332,92220k+Unsafe Printing Function
#6WPtouch – Make your WordPress Website Mobile-Friendly171,46632550k+Text Domain Mismatch
#7Prime Slider Addons for Elementor183,500230100k+Text Domain Mismatch
#8Podlove Podcast Publisher182,3261,4293k+Output Not Escaped
#9Shopping Cart & eCommerce Store185,45917,2984k+Non Prefixed Variable Found
#10WP Import Export Lite1873897940k+Non Prefixed Variable Found
#11WP Directory Kit182,1192,6172k+Non Prefixed Variable Found
#12Element Pack – Widgets, Templates & Addons for Elementor199,448517100k+Text Domain Mismatch
#13Download Monitor194251,36480k+Non Prefixed Hookname Found
#14Event Organiser191,10654420k+Text Domain Mismatch
#15Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution191,218901100k+Exception Not Escaped
#16Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps)193,2753,22810k+Output Not Escaped
#17Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization191,2952,6799k+Output Not Escaped
#18Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)195413853m+Missing Translators Comment
#19Membership Plugin – Kadence Memberships195,0822,9829k+Text Domain Mismatch
#20Scrollsequence – Cinematic Scroll Image Animation Plugin198781,5284k+Non Prefixed Variable Found
#21SendPress Newsletters192,2931,4222k+Output Not Escaped
#22SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments195261,11990k+Non Prefixed Variable Found
#23WP Email Template193423502k+Exception Not Escaped
#24BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot205081,40630k+Non Prefixed Variable Found
#25Brizy – Page Builder2058972070k+Output Not Escaped
#26Filter Everything — WordPress & WooCommerce Filters2056873050k+Output Not Escaped
#27GiveWP – Donation Plugin and Fundraising Platform203,4353,580100k+Output Not Escaped
#28Link Library201,9411,39710k+Unsafe Printing Function
#29MBE eShip205277401k+Non Prefixed Variable Found
#30Brevo – Email, SMS, Web Push, Chat, and more.20460646100k+Missing Unslash
#31MAS Videos205191,6931k+Non Prefixed Variable Found
#32Microthemer Lite – Visual Editor to Customize CSS201,0041,69910k+Non Prefixed Variable Found
#33Pix por Piggly (para Woocommerce)205471954k+Exception Not Escaped
#34Quill Forms | Conversational Multi Step Forms, Surveys & quizzes204013683k+Text Domain Mismatch
#35Robin Image Optimizer – Unlimited Image Optimization, WebP & AVIF20557541100k+Output Not Escaped
#36SpeakOut! Email Petitions208509943k+Missing
#37Trace My IP – Visitor IP Tracker, Stats Analytics & Page Views Counter with Email Alerts208663381k+wp function not compatible with requires wp
#38Razorpay for WooCommerce20974855100k+Non Prefixed Function Found
#39WPJAM Basic203283564k+Output Not Escaped
#40Store Locator WordPress212,3721,57210k+Text Domain Mismatch
#41Backup Migration219811,09380k+Non Prefixed Variable Found
#42bbPress219293,672100k+Non Prefixed Function Found
#43CallTrackingMetrics219232863k+Unsafe Printing Function
#44Captcha Them All213003236k+Output Not Escaped
#45CartFlows – Funnel Builder & Checkout Plugin for WooCommerce21461614200k+Text Domain Mismatch
#46Smart Grid-Layout Design for Contact Form 7211,12673410k+Output Not Escaped
#47Free Downloads WooCommerce214303594k+Output Not Escaped
#48Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More212,5721,2771m+Output Not Escaped
#49eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams211864379k+Non Prefixed Variable Found
#50ERP: Complete HR, Accounting & CRM Suite with Recruitment and WooCommerce CRM Support218295,9665k+Direct Query