PluginScore

WordPress.DB.PreparedSQL.InterpolatedNotPrepared

Interpolated SQL is not prepared

Variables are interpolated into a SQL string before the query is prepared.

critical weight

Why It Shows Up

The scan found dynamic values placed directly inside SQL, often through string interpolation, before `$wpdb->prepare()` can safely bind them.

Why It Matters

Preparing a query after unsafe interpolation does not reliably protect the dynamic value.

How to Fix

  • Replace interpolated variables with placeholders.
  • Pass each dynamic value as a separate `$wpdb->prepare()` argument.
  • Use allowlists for SQL identifiers and directions that cannot be represented as normal values.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#251MotoPress Appointment Booking232,3628572k+Text Domain Mismatch
#252Restaurant Menu and Food Ordering233858532k+Non-prefixed global variable
#253MStore API – Create Native Android & iOS Apps On The Cloud236187643k+SQL query is not prepared
#254MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO234855802k+Missing nonce verification
#255Next Active Directory Integration236832842k+Exception output is not escaped
#256Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery232,129993400k+Text Domain Mismatch
#257Nirweb support23254617800Request data is not unslashed
#258NitroPack – Performance, Page Speed & Cache Plugin for Core Web Vitals, CDN & Image Optimization2331663990k+Output is not escaped
#259Issues and Series for Newspapers, Magazines, Publishers, Writers233467102k+Nonce verification recommended
#260AI Popup231,224636400Text Domain Mismatch
#261Post to Google My Business (Google Business Profile)238451,45210k+Non-prefixed global variable
#262PowerPress Podcasting plugin by Blubrry234,8152,45220k+Output is not escaped
#263Print Anywhere & Create PDFs of Order Receipts, Invoices, Labels & More.231,4854441k+Text Domain Mismatch
#264Redirection23523457100k+Non-prefixed global variable
#265Request a Quote – Quote Forms for Any WordPress Site232401,099900Non-prefixed hook name
#266Revive.so – Bulk Rewrite and Republish Blog Posts23332228700Text Domain Mismatch
#267Robo Gallery – Photo & Image Slider231,29153040k+Output is not escaped
#268SecuPress with Simple SSL – Simple and Performant Security231,6971,60140k+Non-prefixed global variable
#269SEO Redirection Plugin – 301 Redirect Manager2327272710k+Non-prefixed global variable
#270Local Google Analytics for WordPress – caches external requests235511993k+Output is not escaped
#271Tag, Category, and Taxonomy Manager – Autotagger Automatically Add Terms2340586950k+Nonce verification recommended
#272Simple URLs – Link Cloaking, Product Displays, and Affiliate Link Management232952984k+Non-prefixed global variable
#273Image Optimizer, Resizer and CDN – Sirv236161,0041k+Output is not escaped
#274Site Reviews231,62660460k+Output is not escaped
#275Slider Hero with Video Background, Animation231,5651,2533k+Text Domain Mismatch
#276Smart Marketing SMS and Newsletters Forms232,2321,0151k+Text Domain Mismatch
#277SportsPress – Sports Club & League Manager234592,24610k+Non-prefixed global variable
#278Strong Testimonials2319439390k+Nonce verification recommended
#279teachPress237441,5872k+SQL query is not prepared
#280The Events Calendar233,5093,850700k+Text Domain Mismatch
#281UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP236942,43920k+Non-prefixed hook name
#282Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments231211,2272k+Non-prefixed global variable
#283Product Table & List Builder For WooCommerce231,3622,06010k+Non-prefixed global variable
#284Easy Appointment Booking & Scheduling System – Webba Booking Calendar231,6183,3782k+Non-prefixed global variable
#285Predictive Search for WooCommerce23514633700Output is not escaped
#286WP All Import – Product Import for WooCommerce231,47520920k+Non Singular String Literal Domain
#287ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin237,8802,19990k+Text Domain Mismatch
#288WP BackItUp Community Edition232579896k+Non-prefixed global variable
#289Clone2324426240k+Output is not escaped
#290WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses23590876500Non-prefixed function
#291WP-CRM System – Manage Clients and Projects232971,094800Non-prefixed global variable
#292WP Crowdfunding231991,6292k+Non-prefixed global variable
#293WP Hotelier236931,6352k+Non-prefixed global variable
#294Lead Form Data Collection to CRM232111,698400Non-prefixed global variable
#295WP-Lister Lite for Amazon233,0614,177800Output is not escaped
#296FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce239412,17920k+SQL query is not prepared
#297WP Mega Menu239927928k+Non-prefixed global variable
#298WP Migrate Lite – Migration Made Easy23369255200k+Exception output is not escaped
#299Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning231,11820230k+Missing Translators Comment
#300WP STAGING – WordPress Backup, Restore, Migration & Clone231,5041,567100k+Non-prefixed global variable