WordPress.DB.PreparedSQL.NotPrepared
SQL query is not prepared
A database query includes dynamic data without using `$wpdb->prepare()` or an equivalent safe pattern.
Why It Shows Up
The scan found a SQL string passed to `$wpdb` where variables appear to be interpolated or concatenated directly.
Why It Matters
Unprepared SQL can allow SQL injection when user-controlled values reach the query.
How to Fix
- Move dynamic values into placeholders such as `%s`, `%d`, `%f`, or `%i` where supported.
- Pass the values as separate arguments to `$wpdb->prepare()`.
- For table names, column names, and sort directions, use strict allowlists instead of raw user input.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #851 | Maven Algolia | 28 | 148 | 89 | 6k+ | Non Singular String Literal Domain | ||
| #852 | Media Hygiene: Remove or Delete Unused Images and More! | 28 | 654 | 309 | 5k+ | Non Singular String Literal Domain | ||
| #853 | My auctions allegro | 28 | 483 | 235 | 500 | Non Singular String Literal Domain | ||
| #854 | My Sticky Bar – Floating Notification Bar & Sticky Header (formerly myStickymenu) | 28 | 164 | 441 | 100k+ | Non-prefixed global variable | ||
| #855 | Store Hours for WooCommerce | 28 | 525 | 60 | 2k+ | Output is not escaped | ||
| #856 | Order Tracking – WordPress Status Tracking Plugin | 28 | 619 | 773 | 3k+ | Unsafe printing function | ||
| #857 | ووکامرس فارسی | 28 | 157 | 215 | 90k+ | Output is not escaped | ||
| #858 | افزونه حمل و نقل ووکامرس | پست پیشتاز، تیپاکس و پیک موتوری | 28 | 131 | 190 | 20k+ | Missing nonce verification | ||
| #859 | Pixel Gallery Addons for Elementor – Easy Grid, Creative Gallery, Drag and Drop Grid, Custom Grid Layout, Portfolio Gallery | 28 | 146 | 259 | 5k+ | Post Not In exclude | ||
| #860 | Pixelgrade Assistant | 28 | 1,348 | 160 | 2k+ | Text Domain Mismatch | ||
| #861 | Podcast Importer SecondLine | 28 | 356 | 169 | 4k+ | Text Domain Mismatch | ||
| #862 | Product Sync for WooCommerce | 28 | 158 | 375 | 400 | Direct Query | ||
| #863 | Query Wrangler | 28 | 628 | 229 | 700 | Output is not escaped | ||
| #864 | Rating by BestWebSoft | 28 | 509 | 218 | 400 | Text Domain Mismatch | ||
| #865 | ReDi Restaurant Reservation – Instant Restaurant Booking & Table Reservation System | 28 | 1,013 | 239 | 800 | Unsafe printing function | ||
| #866 | Responsive Lightbox & Gallery | 28 | 139 | 513 | 100k+ | Non-prefixed hook name | ||
| #867 | Secure Downloads | 28 | 616 | 406 | 600 | Output is not escaped | ||
| #868 | Transliterator – Multilingual and Multi-script Text Conversion | 28 | 305 | 322 | 3k+ | Output is not escaped | ||
| #869 | Slider Pro | 28 | 583 | 527 | 4k+ | Unsafe printing function | ||
| #870 | Tab – Accordion, FAQ | 28 | 104 | 542 | 1k+ | Non-prefixed global variable | ||
| #871 | Terms descriptions | 28 | 222 | 423 | 1k+ | Non-prefixed function | ||
| #872 | Themesflat Addons For Elementor | 28 | 714 | 227 | 40k+ | Output is not escaped | ||
| #873 | Jetpack VaultPress | 28 | 71 | 362 | 10k+ | Missing nonce verification | ||
| #874 | VG WORT METIS | 28 | 150 | 317 | 900 | Nonce verification recommended | ||
| #875 | WC Fields Factory | 28 | 194 | 369 | 7k+ | Nonce verification recommended | ||
| #876 | Product Gallery Slider, Additional Variation Images for WooCommerce | 28 | 552 | 316 | 20k+ | Output is not escaped | ||
| #877 | WP ADA Compliance Check Basic | 28 | 785 | 177 | 3k+ | Text Domain Mismatch | ||
| #878 | WP GoToWebinar | 28 | 207 | 207 | 700 | Non-prefixed function | ||
| #879 | WhyDonate – FREE Donate button – Crowdfunding – Fundraising | 28 | 216 | 328 | 800 | Non-prefixed global variable | ||
| #880 | WPS Bidouille | 28 | 472 | 215 | 10k+ | Output is not escaped | ||
| #881 | WP Synchro – The Ultimate WordPress Migration Tool | 28 | 243 | 244 | 2k+ | Missing Translators Comment | ||
| #882 | WxSync-标准云微信公众号文章免费采集-任意公众号自动采集付费购买 | 28 | 57 | 138 | 500 | Request data is not unslashed | ||
| #883 | Accordion Slider | 29 | 391 | 447 | 2k+ | Unsafe printing function | ||
| #884 | Advanced coupon for WooCommerce | 29 | 472 | 242 | 900 | Text Domain Mismatch | ||
| #885 | AL Pack | 29 | 13 | 816 | 2k+ | Non-prefixed global variable | ||
| #886 | AppPresser – Mobile App Framework | 29 | 262 | 214 | 1k+ | Text Domain Mismatch | ||
| #887 | Attribute Stock for WooCommerce – Shared Stock & Variable Quantities (Lite Version) | 29 | 481 | 313 | 2k+ | Text Domain Mismatch | ||
| #888 | Better Google Analytics | 29 | 376 | 869 | 2k+ | Non-prefixed global variable | ||
| #889 | Bitcoin Payments – Blockonomics | 29 | 208 | 227 | 2k+ | Output is not escaped | ||
| #890 | Plugin BlueX for WooCommerce | 29 | 431 | 216 | 2k+ | Text Domain Mismatch | ||
| #891 | Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms | 29 | 236 | 369 | 2k+ | Non-prefixed global variable | ||
| #892 | Chained Quiz | 29 | 1,132 | 721 | 1k+ | Text Domain Mismatch | ||
| #893 | CloudSecure WP Security | 29 | 74 | 350 | 100k+ | Request data is not unslashed | ||
| #894 | Countdown, Coming Soon, Maintenance – Countdown & Clock | 29 | 1,735 | 143 | 10k+ | Non Singular String Literal Domain | ||
| #895 | Custom Field Template | 29 | 568 | 530 | 30k+ | wp function not compatible with requires wp | ||
| #896 | Display Tweets | 29 | 135 | 135 | 900 | Non-prefixed global variable | ||
| #897 | Document Gallery | 29 | 183 | 98 | 8k+ | Output is not escaped | ||
| #898 | Interactive Image Map Plugin – Draw Attention | 29 | 620 | 227 | 20k+ | Output is not escaped | ||
| #899 | ECPay Ecommerce for WooCommerce | 29 | 248 | 370 | 2k+ | Missing nonce verification | ||
| #900 | Everest Toolkit | 29 | 145 | 141 | 1k+ | Missing Translators Comment |
