PluginScore

WordPress.DB.PreparedSQL.InterpolatedNotPrepared

Interpolated SQL is not prepared

Variables are interpolated into a SQL string before the query is prepared.

critical weight

Why It Shows Up

The scan found dynamic values placed directly inside SQL, often through string interpolation, before `$wpdb->prepare()` can safely bind them.

Why It Matters

Preparing a query after unsafe interpolation does not reliably protect the dynamic value.

How to Fix

  • Replace interpolated variables with placeholders.
  • Pass each dynamic value as a separate `$wpdb->prepare()` argument.
  • Use allowlists for SQL identifiers and directions that cannot be represented as normal values.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#451Ultimate WP Mail24400546700Unsafe printing function
#452Unlimited Elements For Elementor247102,093300k+Non-prefixed global variable
#453UpdraftPlus: WP Backup & Migration Plugin242772993m+Non-prefixed global variable
#454User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder246633,35350k+Non-prefixed global variable
#455Visitor Traffic Real Time Statistics2447292730k+Non-prefixed global variable
#456WCMultiShipping — Mondial Relay, Inpost & Chronopost for WooCommerce247334995k+Output is not escaped
#457Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels241,6151,37770k+Text Domain Mismatch
#458Disable Updates – Updates Manager, Disable Automatic Updates, Disable All Updates2452213510k+Output is not escaped
#459Coupon Affiliates – Affiliate Plugin for WooCommerce249473,1335k+Non-prefixed global variable
#460Payment Plugins Braintree For WooCommerce247317552k+Output is not escaped
#461Payment Gateway for PayPal on WooCommerce2416363710k+Non-prefixed hook name
#462European VAT Compliance Assistant for WooCommerce245153173k+Output is not escaped
#463AgenWebsite Shipping – Plugin Ongkos Kirim & Generate Resi Otomatis Semua Kurir Indonesia241,2611,072500Text Domain Mismatch
#464WPML Multilingual & Multicurrency for WooCommerce241,4531,618100k+SQL query is not prepared
#465AI ChatBot for eCommerce – WoowBot24144526900Request data is not unslashed
#466WordLift – AI powered SEO – Schema24278949400Non-prefixed hook name
#467Yoast SEO – Advanced SEO with real-time guidance and built-in AI2415938610m+Non-prefixed global variable
#468WP-Appbox244183902k+Missing Arg Domain
#469Auto Affiliate Links243764073k+Output is not escaped
#470WP Discourse241031141k+Nonce verification recommended
#471WP Fastest Cache – WordPress Cache Plugin245417531m+Unsafe printing function
#472Iptanus File Upload245091,32510k+Non-prefixed function
#473WP Helper Premium243,9081,5151k+Text Domain Mismatch
#474WP Hotel Booking241,2321,5337k+Non-prefixed global variable
#475WP Job Portal – AI-Powered Recruitment System for Company or Job Board website24781,1588k+Missing Version
#476WP-Members Membership Plugin2466938250k+Output is not escaped
#477WP Notification Bell247361,591700Non-prefixed global variable
#478پارسی دیت – Parsi Date24106291100k+Non-prefixed hook name
#479WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars248611,57310k+Non-prefixed global variable
#480WP Recipe Maker2449494250k+Non-prefixed global variable
#481WP RSS Aggregator – RSS Import, Feed to Post, Autoblogging, AI Content241,77739440k+Text Domain Mismatch
#482WSMS (formerly WP SMS) – SMS & MMS Notifications with OTP and 2FA for WooCommerce24911,7257k+Non-prefixed hook name
#483WP-Stateless – Google Cloud Storage241,0364824k+Non Singular String Literal Domain
#484WP Travel – Ultimate Travel Booking System, Tour Management Engine242271,9544k+Non-prefixed hook name
#485WP Travel Engine – Tour Booking Plugin – Tour Operator Software242,0125,68920k+Non-prefixed global variable
#486Export All Posts, Products, Orders & Users | WP Ultimate Exporter | WordPress CSV Export243631,1306k+Direct Query
#487Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress242,5812,109100k+Output is not escaped
#488WP User Manager – User Profile Builder & Membership2478753910k+Exception output is not escaped
#489WP Travel Engine – Elementor Widgets | Create Travel Booking Website Using WordPress and Elementor245,9072,13610k+Text Domain Mismatch
#490xili-language241,501523600Output is not escaped
#491YITH WooCommerce Product Add-Ons244602,06920k+Non-prefixed global variable
#492YMC Filter24121,7294k+Non-prefixed global variable
#493Jetpack CRM – Clients, Leads, Invoices, Billing, Email Marketing, & Automation241,2113,15230k+Non-prefixed global variable
#4943DPrint Lite251751,029700Non-prefixed global variable
#495Dynamic Pricing With Discount Rules for WooCommerce251652055k+Non-prefixed global variable
#496AdRotate Banner Manager251,36384620k+Unsafe printing function
#497Advanced WordPress Reset – Debug, Recover & Reset WP2547546420k+Output is not escaped
#498Affiliates256891,4832k+Output is not escaped
#499AliExpress Dropshipping Plugin for WooCommerce Stores255557344k+Text Domain Mismatch
#500All 404 Redirect to Homepage25140301200k+date date