PluginScore

WordPress.DB.PreparedSQL.InterpolatedNotPrepared

Interpolated SQL is not prepared

Variables are interpolated into a SQL string before the query is prepared.

critical weight

Why It Shows Up

The scan found dynamic values placed directly inside SQL, often through string interpolation, before `$wpdb->prepare()` can safely bind them.

Why It Matters

Preparing a query after unsafe interpolation does not reliably protect the dynamic value.

How to Fix

  • Replace interpolated variables with placeholders.
  • Pass each dynamic value as a separate `$wpdb->prepare()` argument.
  • Use allowlists for SQL identifiers and directions that cannot be represented as normal values.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#401MxChat – AI Chatbot & Content Generation for WordPress243,2301,4052k+Text Domain Mismatch
#402My Agile Privacy® – CMP, Cookie Consent & Privacy Tools241,1706747k+Text Domain Mismatch
#403Newsletter – Send awesome emails from WordPress248982,219200k+Non-prefixed global variable
#404Newsletter Subscription Form – User Subscriptions Form, Capture Email243858291k+Non-prefixed global variable
#405Ninja Forms – The Contact Form Builder That Grows With You247491,533600k+Nonce verification recommended
#406NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar2426740440k+Non-prefixed hook name
#407Pagar.me para WooCommerce245491165k+Text Domain Mismatch
#408Paymob for WooCommerce243482885k+Text Domain Mismatch
#409PDF for Gravity Forms + Drag And Drop Template Builder241,457260400wp function not compatible with requires wp
#410PixelYourSite – Your smart PIXEL (TAG) & API Manager241,1762,416500k+Non-prefixed namespace
#411Product Catalog Simple241,5551,9821k+Output is not escaped
#412Product Editor Pro – WooCommerce Bulk Edit: Prices, Stock, Images, Titles, CSV Import & More242,1544,8331k+Non-prefixed global variable
#413ProfileGrid – User Profiles, Groups and Communities244832,4615k+Non-prefixed global variable
#414Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors2436982020k+Nonce verification recommended
#415PickPlugins Question Answer24321,413400Non-prefixed global variable
#416Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker244072,58740k+Non-prefixed hook name
#417Registrations for the Events Calendar – Event Registration Plugin244049447k+Non-prefixed global variable
#418PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes2442158310k+Missing Translators Comment
#419RSFirewall!245635214k+Output is not escaped
#420RSVP and Event Management243456243k+Direct Query
#421Security Plugin, Firewall & Malware Scanner with Auto Removal241,18877030k+Output is not escaped
#422SEO Engine – Smart SEO with AI, Schema & Redirection for WordPress242393041k+Direct Query
#423SEOKEY – Powerful SEO plugin with Expert Insights and SEO Audit246059281k+Non-prefixed global variable
#424Servebolt Optimizer241,9586811k+Text Domain Mismatch
#425Service Box Slider246181,410500Non-prefixed global variable
#426Share This Image247441,5821k+Non-prefixed global variable
#427ShiftController Employee Shift Scheduling24358196700Output is not escaped
#428ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization2492632210k+Output is not escaped
#429Simple Membership242,2971,73440k+Unsafe printing function
#430SiteGuard WP Plugin24359350500k+Output is not escaped
#431Video Slider – Slider Carousel242082,2033k+Request data is not unslashed
#432Smart Variations Images & Swatches for WooCommerce249901,4861k+Non-prefixed global variable
#433MoreConvert Wishlist for WooCommerce243,6816299k+Text Domain Mismatch
#434Sokol: Smart WooCommerce Search245991,5516k+Non-prefixed global variable
#435SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery248321,8913k+Non-prefixed global variable
#436SiteOrigin Widgets Bundle24605455400k+Output is not escaped
#437Spotlight Social Feeds – Block, Shortcode, and Widget2441114760k+Output is not escaped
#438Squad Modules Lite – Free Divi 5 & Divi 4 Modules for Divi Builder246051,4721k+Non-prefixed global variable
#439GEO Plugin by Squirrly SEO241,19522430k+Missing Translators Comment
#440Stripe Payment Forms by WP Simple Pay – Accept Credit Card Payments + Subscriptions with Stripe246346529k+Exception output is not escaped
#441Sugar Calendar – Events Calendar, Event Tickets, and Events Management Platform2442895610k+Output is not escaped
#442Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers243601,4721k+Nonce verification recommended
#443Tainacan241385921k+Direct Query
#444Team Members – Multi Language Supported Team Plugin242,08111,2067k+Non-prefixed global variable
#445Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud!24167225300k+Nonce verification recommended
#446TI WooCommerce Wishlist24467546100k+Output is not escaped
#447Tutor LMS – eLearning and online course solution243284,409100k+Non-prefixed global variable
#448Ultra Addons for Contact Form 7241,54345260k+Text Domain Mismatch
#449Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin249382,935200k+Non-prefixed global variable
#450Ultimate Product Catalog245545255k+Unsafe printing function