PluginScore

WordPress.DB.PreparedSQL.NotPrepared

SQL query is not prepared

A database query includes dynamic data without using `$wpdb->prepare()` or an equivalent safe pattern.

critical weight

Why It Shows Up

The scan found a SQL string passed to `$wpdb` where variables appear to be interpolated or concatenated directly.

Why It Matters

Unprepared SQL can allow SQL injection when user-controlled values reach the query.

How to Fix

  • Move dynamic values into placeholders such as `%s`, `%d`, `%f`, or `%i` where supported.
  • Pass the values as separate arguments to `$wpdb->prepare()`.
  • For table names, column names, and sort directions, use strict allowlists instead of raw user input.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsUpdatedTop Issue
#601Foxtool All-in-One: Contact chat button, Custom login, Media optimize images271,6293607k+Unsafe Printing Function
#602GSpeech TTS – WordPress Text To Speech Plugin278423323k+Output Not Escaped
#603Import Eventbrite Events271565753k+Non Prefixed Variable Found
#604iQ Block Country2716424520k+Missing Unslash
#605Login Security Solution272161544k+Output Not Escaped
#606MakeCommerce for WooCommerce278264523k+Text Domain Mismatch
#607MaxGalleria272785672k+Non Prefixed Variable Found
#608MLSImport – Download and synchronize real estate data from various MLS (Multiple Listing Services)271545515k+Non Prefixed Variable Found
#609Nextend Social Login and Register271,668243200k+Output Not Escaped
#610OOPSpam Anti-Spam: Spam Protection for WordPress Forms & Comments (No CAPTCHA)272725316k+Missing Unslash
#611Presto Player27131124100k+Missing Arg Domain
#612Rate My Post – Star Rating Plugin by FeedbackWP2722236020k+Output Not Escaped
#613Simple Download Monitor2721827320k+Output Not Escaped
#614StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart27893772k+Non Prefixed Variable Found
#615Transbank Webpay2719821110k+Non Prefixed Variable Found
#616VOD Infomaniak2779738520k+Output Not Escaped
#617Watu Quiz271,0891,0143k+Output Not Escaped
#618WP-DBManager2738630460k+Non Prefixed Variable Found
#619Email Marketing Plugin – WP Email Capture273832621k+Output Not Escaped
#620WP Events Manager2729441530k+Output Not Escaped
#621WP Hide & Security Enhancer2712437550k+Input Not Sanitized
#622WPBase Cache271891132k+Text Domain Mismatch
#623YARPP – Yet Another Related Posts Plugin27191331100k+Non Prefixed Variable Found
#624Divi Torque Lite – Divi Modules for the Divi Builder & Theme2813225650k+Non Prefixed Variable Found
#625AForms — Form Builder for Price Calculator & Cost Estimation28564953k+Text Domain Mismatch
#626Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms286493579k+Text Domain Mismatch
#627Contact Form by BestWebSoft – Advanced WP Contact Form Builder for WordPress2846533830k+Text Domain Mismatch
#628Maspik – Ultimate Spam Protection2821286430k+Missing
#629Deposits & Partial Payments for WooCommerce – Bayna285933361k+Output Not Escaped
#630Dynamic User Directory284032561k+Output Not Escaped
#631Discount Rules and Dynamic Pricing for WooCommerce2818233410k+Output Not Escaped
#632easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution284058105k+Missing
#633گیت‌لند | درگاه پرداخت هوشمند گیت‌لند283272352k+Output Not Escaped
#634Geo Mashup287752321k+Text Domain Mismatch
#635Kadence Starter Templates — Predesigned Website Templates28312215300k+Missing Arg Domain
#636Maven Algolia28148896k+Non Singular String Literal Domain
#637Media Hygiene: Remove or Delete Unused Images and More!286543095k+Non Singular String Literal Domain
#638My Sticky Bar – Floating Notification Bar & Sticky Header (formerly myStickymenu)28161400100k+Non Prefixed Variable Found
#639Store Hours for WooCommerce28525602k+Output Not Escaped
#640Order Tracking – WordPress Status Tracking Plugin286197723k+Unsafe Printing Function
#641ووکامرس فارسی2815721590k+Output Not Escaped
#642افزونه حمل و نقل ووکامرس | پست پیشتاز، تیپاکس و پیک موتوری2813119020k+Missing
#643Pixel Gallery Addons for Elementor – Easy Grid, Creative Gallery, Drag and Drop Grid, Custom Grid Layout, Portfolio Gallery281432585k+Post Not In exclude
#644Podcast Importer SecondLine283561694k+Text Domain Mismatch
#645Responsive Lightbox & Gallery28139513100k+Non Prefixed Hookname Found
#646Transliterator – Multilingual and Multi-script Text Conversion283053203k+Output Not Escaped
#647Slider Pro285835274k+Unsafe Printing Function
#648Tab – Accordion, FAQ281045421k+Non Prefixed Variable Found
#649Themesflat Addons For Elementor2871422740k+Output Not Escaped
#650Jetpack VaultPress287136210k+Missing