PluginScore

WordPress.DB.PreparedSQL.NotPrepared

SQL query is not prepared

A database query includes dynamic data without using `$wpdb->prepare()` or an equivalent safe pattern.

critical weight

Why It Shows Up

The scan found a SQL string passed to `$wpdb` where variables appear to be interpolated or concatenated directly.

Why It Matters

Unprepared SQL can allow SQL injection when user-controlled values reach the query.

How to Fix

  • Move dynamic values into placeholders such as `%s`, `%d`, `%f`, or `%i` where supported.
  • Pass the values as separate arguments to `$wpdb->prepare()`.
  • For table names, column names, and sort directions, use strict allowlists instead of raw user input.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#451LatePoint – Calendar Booking Plugin for Appointments and Events241,841937100k+Output is not escaped
#452LearnPress – Backup & Migration Tool243854695k+Output is not escaped
#453LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes244141,17610k+Non-prefixed global variable
#454Limit Attempts by BestWebSoft – WordPress Anti-Bot and Security Plugin for Login and Forms245635484k+Text Domain Mismatch
#455Local Delivery Drivers for WooCommerce241,8321,483900Non-prefixed global variable
#456Event Booking Manager for WooCommerce249682,1227k+Non-prefixed global variable
#457Mailchimp for WooCommerce24523663200k+Non-prefixed global variable
#458MailerPress – Email Marketing, Newsletter, Email Automation & WooCommerce Emails247723,8531k+Direct Query
#459Mailjet Email Marketing2443520610k+Unsafe printing function
#460Mang Board WP241,2494,7209k+Non-prefixed global variable
#461Media Library Folders2488980710k+Text Domain Mismatch
#462Timetable and Event Schedule by MotoPress2445623230k+Output is not escaped
#463MxChat – AI Chatbot & Content Generation for WordPress243,1571,3852k+Text Domain Mismatch
#464My WP Customize Admin/Frontend241,2492928k+Unsafe printing function
#465My Agile Privacy® – CMP, Cookie Consent & Privacy Tools241,1706747k+Text Domain Mismatch
#466Newsletter – Send awesome emails from WordPress248982,214200k+Non-prefixed global variable
#467Newsletter Subscription Form – User Subscriptions Form, Capture Email243858291k+Non-prefixed global variable
#468NEX-Forms – Ultimate Forms Plugin for WordPress242,0081,1956k+Text Domain Mismatch
#469Pagar.me para WooCommerce245491165k+Text Domain Mismatch
#470Page Builder: Pagelayer – Drag and Drop website builder24769556400k+Output is not escaped
#471Participants Database249518947k+SQL query is not prepared
#472Paymob for WooCommerce243592886k+Text Domain Mismatch
#473PixelYourSite – Your smart PIXEL (TAG) & API Manager241,1602,407500k+Non-prefixed namespace
#474Product Catalog Simple241,5551,9821k+Output is not escaped
#475Post Affiliate Pro24293335500Nonce verification recommended
#476Premmerce Brands for WooCommerce247001,3442k+Non-prefixed global variable
#477PrettyLinks – Affiliate Links, Link Branding, Link Tracking, Marketing and Stripe Payments Plugin244491,137300k+Nonce verification recommended
#478Product Editor Pro – WooCommerce Bulk Edit: Prices, Stock, Images, Titles, CSV Import & More242,1544,8331k+Non-prefixed global variable
#479ProfileGrid – User Profiles, Groups and Communities244732,4636k+Non-prefixed global variable
#480Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors2436982020k+Nonce verification recommended
#481Pz-LinkCard249511,58120k+Non-prefixed global variable
#482QuadMenu – Mega Menu242,12945510k+Output is not escaped
#483PickPlugins Question Answer24321,413400Non-prefixed global variable
#484Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker244062,58140k+Non-prefixed hook name
#485reGenerate Thumbnails Advanced2422012270k+Unsafe printing function
#486Registrations for the Events Calendar – Event Registration Plugin244059437k+Non-prefixed global variable
#487RSFirewall!245635214k+Output is not escaped
#488Screen Reader Accessibility – WCAG, Text-to-Speech & AI Accessibility Fixes24235330600Non-prefixed global variable
#489Security Plugin, Firewall & Malware Scanner with Auto Removal241,19176930k+Output is not escaped
#490SEO Engine – Smart SEO with AI, Schema & Redirection for WordPress242393041k+Direct Query
#491SEOKEY – Powerful SEO plugin with Expert Insights and SEO Audit246059281k+Non-prefixed global variable
#492Servebolt Optimizer241,9586811k+Text Domain Mismatch
#493Service Box Slider246181,410500Non-prefixed global variable
#494Share This Image247441,5821k+Non-prefixed global variable
#495ShiftController Employee Shift Scheduling24358196700Output is not escaped
#496Shortcodes Ultimate – Content Elements246561,552400k+Non-prefixed global variable
#497ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization2492632210k+Output is not escaped
#498Simple Membership242,3731,78940k+Unsafe printing function
#499SiteGuard WP Plugin24361346500k+Output is not escaped
#500Sitepact's Contact Form 7 Extension For Klaviyo245411,412500Non-prefixed global variable