PluginScore

WordPress.DB.PreparedSQL.NotPrepared

SQL query is not prepared

A database query includes dynamic data without using `$wpdb->prepare()` or an equivalent safe pattern.

critical weight

Why It Shows Up

The scan found a SQL string passed to `$wpdb` where variables appear to be interpolated or concatenated directly.

Why It Matters

Unprepared SQL can allow SQL injection when user-controlled values reach the query.

How to Fix

  • Move dynamic values into placeholders such as `%s`, `%d`, `%f`, or `%i` where supported.
  • Pass the values as separate arguments to `$wpdb->prepare()`.
  • For table names, column names, and sort directions, use strict allowlists instead of raw user input.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#751OOPSpam Anti-Spam: Spam Protection for WordPress Forms & Comments (No CAPTCHA)262725766k+Request data is not unslashed
#752Open User Map – Interactive Leaflet Maps2689398610k+Non-prefixed global variable
#753Paytium: Mollie payment forms & donations265065513k+Unsafe printing function
#754PDF for WPForms + Drag and Drop Template Builder266741131k+wp function not compatible with requires wp
#755LoginWP (Formerly Peter's Login Redirect)2640127890k+Output is not escaped
#756Polylang2636564800k+Non-prefixed hook name
#757Portfolio by BestWebSoft – Work and Projects Presentation Plugin for WordPress26525240600Text Domain Mismatch
#758Product Table For WooCommerce26191858600Non-prefixed global variable
#759Profile Extra Fields by BestWebSoft265145322k+Text Domain Mismatch
#760Related Posts Thumbnails Plugin for WordPress2638219820k+Output is not escaped
#761RestaurantPress26265518600Output is not escaped
#762Send Users Email – Email Subscribers, Email Marketing Newsletter261884155k+Non-prefixed global variable
#763SP Move Login268812156k+Text Domain Mismatch
#764Sliced Invoices – WordPress Invoice Plugin266844555k+Output is not escaped
#765Video Gallery – Vimeo and YouTube Gallery265617946k+Non-prefixed global variable
#766StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart261254202k+Non-prefixed global variable
#767Subscriber by BestWebSoft26550376900Text Domain Mismatch
#768Ultimate Reviews26515345400Output is not escaped
#769UpdraftCentral Dashboard262671806k+Missing Translators Comment
#770URL Image Importer26142239700Missing nonce verification
#771User Submitted Posts – Enable Users to Submit Posts from the Front End2669939610k+Text Domain Mismatch
#772Visitors Online by BestWebSoft265122691k+Text Domain Mismatch
#773XL NMI Gateway for WooCommerce266954361k+Text Domain Mismatch
#774WP Flashy Marketing Automation264321862k+Text Domain Mismatch
#775WPCOM Member264326381k+Non Singular String Literal Domain
#776Divi Torque Lite – Divi Modules for the Divi Builder & Theme2714426550k+Non-prefixed global variable
#777Amazon Product in a Post Plugin27362416800Output is not escaped
#778Apollo13 Framework Extensions2717127320k+Non-prefixed global variable
#779Arconix FAQ275522016k+Text Domain Mismatch
#780BackUpWordPress2724527190k+Non-prefixed global variable
#781Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms277203675k+Text Domain Mismatch
#782WP Zoho for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms – CRM, Bigin276923813k+Text Domain Mismatch
#783Comment Link Remove and Other Comment Tools276911327k+Text Domain Mismatch
#784Contact Form Generator : Creative form builder for WordPress271,0761,510800Output is not escaped
#785Duplicate Post27447274300k+Unsafe printing function
#786Polls CP27399500400Output is not escaped
#787Cyrlitera – Transliteration of Links and File Names2745320440k+Output is not escaped
#788Echo Knowledge Base – Documentation, FAQs, Chat & Smart Search2728975110k+Output is not escaped
#789EZ SQL Reports Shortcode Widget and DB Backup27165158500Output is not escaped
#790CM Tooltip Glossary276111887k+Output is not escaped
#791Events Calendar for GeoDirectory271,2294622k+Text Domain Mismatch
#792FG Joomla to WordPress272781017k+Unsafe printing function
#793Foxtool All-in-One: Contact chat button, Custom login, Media optimize images271,6293607k+Unsafe printing function
#794StylePress for Elementor27767283600Text Domain Mismatch
#795Gravity Forms + Stripe27368210600Output is not escaped
#796GSpeech TTS – WordPress Text To Speech Plugin278423333k+Output is not escaped
#797ImageRecycle pdf & image compression273292041k+Text Domain Mismatch
#798Import Eventbrite Events271565753k+Non-prefixed global variable
#799iQ Block Country2716424520k+Request data is not unslashed
#800Login Security Solution272161544k+Output is not escaped