PluginScore

WordPress.DB.PreparedSQL.InterpolatedNotPrepared

Interpolated SQL is not prepared

Variables are interpolated into a SQL string before the query is prepared.

critical weight

Why It Shows Up

The scan found dynamic values placed directly inside SQL, often through string interpolation, before `$wpdb->prepare()` can safely bind them.

Why It Matters

Preparing a query after unsafe interpolation does not reliably protect the dynamic value.

How to Fix

  • Replace interpolated variables with placeholders.
  • Pass each dynamic value as a separate `$wpdb->prepare()` argument.
  • Use allowlists for SQL identifiers and directions that cannot be represented as normal values.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#151PAYCOMET for WooCommerce221,2064232k+Text Domain Mismatch
#152Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App221,5812,326300k+Non-prefixed global variable
#153Premium Addons for Elementor – Powerful Elementor Templates & Widgets222331,036700k+Non-prefixed hook name
#154Prime Mover – Migrate WordPress Website & Backups221,3261,60010k+Non-prefixed global variable
#155Product Catalog Feed by PixelYourSite225813578k+Output is not escaped
#156Pronamic Pay222581,0772k+Non-prefixed global variable
#157RealPress – Real Estate Plugin226041,167500Non-prefixed global variable
#158Restrict User Access – Ultimate Membership & Content Protection229771,84010k+Non-prefixed global variable
#159Salon Booking System – Free Version226556202k+Missing direct file access protection
#160Simple Job Board226341,35510k+Non-prefixed global variable
#161Slim Jetpack222,5861,9472k+Text Domain Mismatch
#162NextScripts: Social Networks Auto-Poster222,4081,13330k+Output is not escaped
#163Swift Performance Lite222,3461,3256k+Text Domain Mismatch
#164Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent222255198k+error log error log
#165Ultimeter227511,3441k+Non-prefixed global variable
#166Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin225322,36740k+Direct Query
#167Unlimited Elements Blocks Library227081,822400Non-prefixed global variable
#168Search & Replace Everything – Quick and Easy Way to Find and Replace Text, Links221,0441,79720k+Non-prefixed global variable
#169Welcart e-Commerce2210,37810,93110k+Text Domain Mismatch
#170UserFeedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds22444243200k+Text Domain Mismatch
#171WCFM – Frontend Manager for WooCommerce224,7545,05420k+Non-prefixed global variable
#172WCFM Marketplace – Multivendor Marketplace for WooCommerce221,9341,96610k+Non-prefixed global variable
#173Wenprise WeChatPay Payment Gateway For WooCommerce22443178400Exception output is not escaped
#174WooCommerce221,3596,1727m+Non-prefixed global variable
#175Advanced AJAX Product Filters222,6831,20550k+Text Domain Mismatch
#176CoDesigner – All in One Elementor WooCommerce Builder224,1317745k+Text Domain Mismatch
#177ManageWP Worker225075651m+Non-prefixed class
#178File Manager227405201m+Unsafe printing function
#179WP Fusion Lite – Marketing Automation and CRM Integration for WordPress222756835k+Nonce verification recommended
#180WP Umbrella: Update Backup Restore & Monitoring2292191970k+Exception output is not escaped
#181SchedulePress – Auto Post & Publish, Auto Social Share, Schedule Posts with Editorial Calendar & Missed Schedule Post Publisher2230724510k+Output is not escaped
#182User Frontend: AI Powered Frontend Posting, User Directory, Profile Builder, Membership & User Registration222871,43220k+Non-prefixed global variable
#183WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell226,0042,7645k+Text Domain Mismatch
#184ShopWP22430225700Text Domain Mismatch
#185YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports2265443510k+Exception output is not escaped
#186Recipe Cards For Your Food Blog from Zip Recipes221,1261,7311k+Non-prefixed global variable
#187Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce231,1851,0271k+Text Domain Mismatch
#188Advanced Custom Fields: Extended231,885329100k+Text Domain Mismatch
#189Frontend Admin by DynamiApps235,9383,2089k+Text Domain Mismatch
#190Admin and Site Enhancements (ASE)23137330200k+Nonce verification recommended
#191Advanced Ads – Ad Manager & AdSense23559719100k+Non-prefixed global variable
#192Advanced Form Integration — Connect Forms to 200+ Apps235,7834,68710k+wp function not compatible with requires wp
#193Advanced Product Labels for WooCommerce2392155920k+Text Domain Mismatch
#194AI Engine – The Chatbot, AI Framework & MCP for WordPress23408539100k+error log error log
#195Fullscreen Menu235371,2872k+Non-prefixed global variable
#196AR for WordPress23151499400Non-prefixed global variable
#197BA Book Everything231,1841,08610k+Output is not escaped
#198Kadence Security – Password, Two Factor Authentication, and Brute Force Protection231,053967700k+Missing Translators Comment
#199BSK PDF Manager231,5766257k+Text Domain Mismatch
#200BuddyDrive237221,5971k+Non-prefixed global variable