PluginScore

WordPress.DB.PreparedSQL.NotPrepared

SQL query is not prepared

A database query includes dynamic data without using `$wpdb->prepare()` or an equivalent safe pattern.

critical weight

Why It Shows Up

The scan found a SQL string passed to `$wpdb` where variables appear to be interpolated or concatenated directly.

Why It Matters

Unprepared SQL can allow SQL injection when user-controlled values reach the query.

How to Fix

  • Move dynamic values into placeholders such as `%s`, `%d`, `%f`, or `%i` where supported.
  • Pass the values as separate arguments to `$wpdb->prepare()`.
  • For table names, column names, and sort directions, use strict allowlists instead of raw user input.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsUpdatedTop Issue
#551WP Yelp Review Slider254296451k+Non-prefixed global variable
#552WPCargo Track & Trace2523955710k+Non-prefixed global variable
#553Team Members Showcase255911,4944k+Non-prefixed global variable
#554WPvivid Backup for MainWP258181,79410k+Missing nonce verification
#555WPvivid — Backup, Migration & Staging258991,461900k+Non-prefixed namespace
#556Video Gallery – YouTube Gallery, Playlist & Video Grid252751,0702k+Non-prefixed hook name
#557YT Player – Embed and Customize Video Players253,1632611k+Output is not escaped
#558Blog Floating Button267052409k+Output is not escaped
#559Booking Manager – Sync WP Booking Calendar – Import Events, Export Bookings to ICS Calendar265262635k+Output is not escaped
#560Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty26113671400k+Non-prefixed global variable
#561Database for Contact Form 7, WPforms, Elementor forms2631748960k+Non-prefixed global variable
#562Ditty – Responsive News Tickers, Sliders, and Lists2656148430k+Output is not escaped
#563Easy Appointments2613556910k+Alternative PHP tag found
#564ezCache2612726910k+Direct Query
#565Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager2611359790k+Non-prefixed global variable
#566FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.)265914162k+Exception output is not escaped
#567Photo Gallery by Ays – Responsive Image Gallery264638181k+Output is not escaped
#568Kadence Central – Site Management, Backups, Security, and Reporting2646221330k+Text Domain Mismatch
#569Loco Translate264542421m+Output is not escaped
#570Media File Renamer: Rename for better SEO (AI-Powered)2614817040k+Direct Query
#571Hotel Booking266909404k+Unsafe printing function
#572Open User Map – Interactive Leaflet Maps2689398610k+Non-prefixed global variable
#573Paytium: Mollie payment forms & donations265065513k+Unsafe printing function
#574LoginWP (Formerly Peter's Login Redirect)2640127890k+Output is not escaped
#575Polylang2636564800k+Non-prefixed hook name
#576Profile Extra Fields by BestWebSoft265145322k+Text Domain Mismatch
#577Related Posts Thumbnails Plugin for WordPress2638219820k+Output is not escaped
#578Send Users Email – Email Subscribers, Email Marketing Newsletter261884155k+Non-prefixed global variable
#579SP Move Login268812156k+Text Domain Mismatch
#580Sliced Invoices – WordPress Invoice Plugin266844555k+Output is not escaped
#581Video Gallery – Vimeo and YouTube Gallery265617946k+Non-prefixed global variable
#582UpdraftCentral Dashboard262671806k+Missing Translators Comment
#583User Submitted Posts – Enable Users to Submit Posts from the Front End2669939610k+Text Domain Mismatch
#584Visitors Online by BestWebSoft265122691k+Text Domain Mismatch
#585XL NMI Gateway for WooCommerce266954361k+Text Domain Mismatch
#586WP Flashy Marketing Automation264321862k+Text Domain Mismatch
#587WPCOM Member264326381k+Non Singular String Literal Domain
#588Apollo13 Framework Extensions2717127320k+Non-prefixed global variable
#589Arconix FAQ275522016k+Text Domain Mismatch
#590BackUpWordPress2724527190k+Non-prefixed global variable
#591Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms277203675k+Text Domain Mismatch
#592WP Zoho for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms – CRM, Bigin276923813k+Text Domain Mismatch
#593Comment Link Remove and Other Comment Tools276911327k+Text Domain Mismatch
#594Duplicate Post27447274300k+Unsafe printing function
#595Cyrlitera – Transliteration of Links and File Names2745320440k+Output is not escaped
#596Echo Knowledge Base – Documentation, FAQs, Chat & Smart Search2728975110k+Output is not escaped
#597CM Tooltip Glossary276111888k+Output is not escaped
#598Events Calendar for GeoDirectory271,2294622k+Text Domain Mismatch
#599FG Joomla to WordPress272781017k+Unsafe printing function
#600Foxtool All-in-One: Contact chat button, Custom login, Media optimize images271,6293607k+Unsafe printing function