PluginScore

WordPress.DB.PreparedSQL.NotPrepared

SQL query is not prepared

A database query includes dynamic data without using `$wpdb->prepare()` or an equivalent safe pattern.

critical weight

Why It Shows Up

The scan found a SQL string passed to `$wpdb` where variables appear to be interpolated or concatenated directly.

Why It Matters

Unprepared SQL can allow SQL injection when user-controlled values reach the query.

How to Fix

  • Move dynamic values into placeholders such as `%s`, `%d`, `%f`, or `%i` where supported.
  • Pass the values as separate arguments to `$wpdb->prepare()`.
  • For table names, column names, and sort directions, use strict allowlists instead of raw user input.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#501Create251,5587696k+Text Domain Mismatch
#502All-in-one Sticky Floating Contact Form, Call, Click to Chat, and 50+ Social Icon Tabs – My Sticky Elements2535259740k+Non-prefixed global variable
#503Nexter Extension – Security, Performance, Code Snippets & Site Toolkit2519871010k+Nonce verification recommended
#504NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar2525739740k+Non-prefixed hook name
#505Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content256801,513300k+Non-prefixed global variable
#506phpinfo() WP — Site Health, PHP Compatibility & Server Audit252767043k+Non-prefixed global variable
#507Poll Maker by AYS – Versus Polls, Anonymous Polls, Image Polls254861,4147k+Non-prefixed global variable
#508Post Snippets – Custom WordPress Code Snippets Customizer258081,65420k+Non-prefixed global variable
#509Quiz Maker by AYS255053,01520k+Non-prefixed global variable
#510Quttera ThreatSign – Web Malware Scanner for WordPress2533447110k+Non-prefixed global variable
#511reSmush.it : The original free image compressor and optimizer plugin2515569100k+Output is not escaped
#512Secure Copy Content Protection and Content Locking2595879920k+Output is not escaped
#513ShopMagic – email automation2522814510k+Exception output is not escaped
#514Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin2596073860k+Text Domain Mismatch
#515Simply Static – The Static Site Generator2516344630k+Non-prefixed hook name
#516Sitemap by click5252861326k+Unsafe printing function
#517Affiliate Program Suite — SliceWP Affiliates251,2912,08910k+Output is not escaped
#518Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management2538793510k+SQL query is not prepared
#519SupportCandy – Helpdesk & Customer Support Ticket System254341,35710k+Direct Query
#520Survey Maker by AYS255662,3976k+Non-prefixed global variable
#521TemplateSpare – 1000+ WordPress Starter Templates & Full Site Migration Tool | 1-Click Import/Export & No-Code Builder257051,58710k+Non-prefixed global variable
#522Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin251192,7062k+Non-prefixed global variable
#523TrackShip for WooCommerce254219576k+Non-prefixed global variable
#524TranslatePress – Translate Multilingual sites with AI Translation254521,541400k+Non-prefixed hook name
#525Ultimate Post Kit Addons for Elementor2518241230k+Missing nonce verification
#526Product Customer List for WooCommerce256101,3349k+Non-prefixed global variable
#527weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot252795184k+Non-prefixed global variable
#528weForms – Easy Drag & Drop Contact Form Builder For WordPress2591645010k+Output is not escaped
#529PDF Builder for WooCommerce. Create invoices,packing slips and more253725032k+Non-prefixed global variable
#530Product Table for WooCommerce251838965k+Non-prefixed global variable
#531Pay with Vipps and MobilePay for WooCommerce258455095k+Output is not escaped
#532Wordfence Login Security2524841870k+Output is not escaped
#533WP Airbnb Review Slider253256461k+Non-prefixed global variable
#534WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards251,4311,27010k+Output is not escaped
#535WP-DownloadManager256075083k+Unsafe printing function
#536WP Review Slider251,1862,2796k+Non-prefixed global variable
#537WP Go Maps – Google Map, OpenStreetMap, Leaflet Map254,9961,008300k+Unsafe printing function
#538WP Google Review Slider251,3672,58230k+Non-prefixed global variable
#539WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan257271,55450k+Non-prefixed global variable
#540Nested Pages2567456090k+Non-prefixed global variable
#541WP-Polls2561863940k+Unsafe printing function
#542WP Popups – WordPress Popup builder2544034230k+Output is not escaped
#543Perfect Images: Regenerate Thumbnails, Image Sizes, WebP & AVIF2515411860k+Non-prefixed global variable
#544Smush – Image Optimization, Compression, Lazy Load, WebP & CDN252525661m+Non-prefixed hook name
#545Wp Social Login and Register Social Counter258073890k+Non-prefixed global variable
#546WP Spell Check2564,3902k+Direct Query
#547WP Statistics – Simple, privacy-friendly Google Analytics alternative256102,465600k+Non-prefixed global variable
#548WP TripAdvisor Review Slider259582,0588k+Non-prefixed global variable
#549WP Yelp Review Slider254296451k+Non-prefixed global variable
#550WPCargo Track & Trace2523955710k+Non-prefixed global variable