PluginScore

WordPress.DB.PreparedSQL.NotPrepared

SQL query is not prepared

A database query includes dynamic data without using `$wpdb->prepare()` or an equivalent safe pattern.

critical weight

Why It Shows Up

The scan found a SQL string passed to `$wpdb` where variables appear to be interpolated or concatenated directly.

Why It Matters

Unprepared SQL can allow SQL injection when user-controlled values reach the query.

How to Fix

  • Move dynamic values into placeholders such as `%s`, `%d`, `%f`, or `%i` where supported.
  • Pass the values as separate arguments to `$wpdb->prepare()`.
  • For table names, column names, and sort directions, use strict allowlists instead of raw user input.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#701Send Users Email – Email Subscribers, Email Marketing Newsletter261884155k+Non-prefixed global variable
#702SP Move Login268812156k+Text Domain Mismatch
#703Sliced Invoices – WordPress Invoice Plugin266844555k+Output is not escaped
#704Video Gallery – Vimeo and YouTube Gallery265617946k+Non-prefixed global variable
#705StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart261254202k+Non-prefixed global variable
#706Subscriber by BestWebSoft265503761k+Text Domain Mismatch
#707UpdraftCentral Dashboard262671806k+Missing Translators Comment
#708URL Image Importer26142239700Missing nonce verification
#709User Submitted Posts – Enable Users to Submit Posts from the Front End2669939610k+Text Domain Mismatch
#710Visitors Online by BestWebSoft265122691k+Text Domain Mismatch
#711XL NMI Gateway for WooCommerce266954361k+Text Domain Mismatch
#712WP Flashy Marketing Automation264321862k+Text Domain Mismatch
#713WPCOM Member264326381k+Non Singular String Literal Domain
#714Amazon Product in a Post Plugin27362416800Output is not escaped
#715Apollo13 Framework Extensions2717127320k+Non-prefixed global variable
#716Arconix FAQ275522016k+Text Domain Mismatch
#717BackUpWordPress2724527190k+Non-prefixed global variable
#718Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms277203675k+Text Domain Mismatch
#719WP Zoho for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms – CRM, Bigin276923813k+Text Domain Mismatch
#720Comment Link Remove and Other Comment Tools276911327k+Text Domain Mismatch
#721Contact Form Generator : Creative form builder for WordPress271,0761,510800Output is not escaped
#722Duplicate Post27447274300k+Unsafe printing function
#723Cyrlitera – Transliteration of Links and File Names2745320440k+Output is not escaped
#724Echo Knowledge Base – Documentation, FAQs, Chat & Smart Search2728975110k+Output is not escaped
#725CM Tooltip Glossary276111888k+Output is not escaped
#726Events Calendar for GeoDirectory271,2294622k+Text Domain Mismatch
#727FG Joomla to WordPress272781017k+Unsafe printing function
#728Foxtool All-in-One: Contact chat button, Custom login, Media optimize images271,6293607k+Unsafe printing function
#729StylePress for Elementor27767283600Text Domain Mismatch
#730Gravity Forms + Stripe27368210600Output is not escaped
#731GSpeech TTS – WordPress Text To Speech Plugin278423323k+Output is not escaped
#732ImageRecycle pdf & image compression273292041k+Text Domain Mismatch
#733Import Eventbrite Events271565753k+Non-prefixed global variable
#734iQ Block Country2716424520k+Request data is not unslashed
#735Login Security Solution272161544k+Output is not escaped
#736MakeCommerce for WooCommerce278264523k+Text Domain Mismatch
#737MaxGalleria272785672k+Non-prefixed global variable
#738Memberful – Membership Plugin273513361k+Text Domain Mismatch
#739MLSImport – Download and synchronize real estate data from various MLS (Multiple Listing Services)271545515k+Non-prefixed global variable
#740Nextend Social Login and Register271,668243200k+Output is not escaped
#741OOPSpam Anti-Spam: Spam Protection for WordPress Forms & Comments (No CAPTCHA)272715686k+Request data is not unslashed
#742Rate My Post – Star Rating Plugin by FeedbackWP2722236020k+Output is not escaped
#743Sign-up Sheets273253631k+Output is not escaped
#744Simple Download Monitor2721827320k+Output is not escaped
#745Terms & Conditions Per Product275331,336800Non-prefixed global variable
#746Transbank Webpay2719821110k+Non-prefixed global variable
#747Ultimate Watermark – Image Watermark, Image Protection & Bulk Watermarking271643031k+Nonce verification recommended
#748VOD Infomaniak2779738520k+Output is not escaped
#749Watu Quiz271,0891,0143k+Output is not escaped
#750Data Exchange for WooCommerce and 1C:Enterprise/1С:Предприятие27922501k+Non-prefixed global variable