PluginScore

WordPress.DB.PreparedSQL.NotPrepared

SQL query is not prepared

A database query includes dynamic data without using `$wpdb->prepare()` or an equivalent safe pattern.

critical weight

Why It Shows Up

The scan found a SQL string passed to `$wpdb` where variables appear to be interpolated or concatenated directly.

Why It Matters

Unprepared SQL can allow SQL injection when user-controlled values reach the query.

How to Fix

  • Move dynamic values into placeholders such as `%s`, `%d`, `%f`, or `%i` where supported.
  • Pass the values as separate arguments to `$wpdb->prepare()`.
  • For table names, column names, and sort directions, use strict allowlists instead of raw user input.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#1201Log HTTP Requests357182k+Interpolated SQL is not prepared
#1202Login Page Styler – Custom WordPress Login Page Customizer & Security351251682k+Missing Arg Domain
#1203MainWP Child Reports3549116100k+Non-prefixed hook name
#1204Mark Posts3530341k+Output is not escaped
#1205Marquee image crawler35168136700Non-prefixed global variable
#1206Mechanic Visitor Counter35240668k+Output is not escaped
#1207Moyasar35436128700Text Domain Mismatch
#1208Nginx Cache Controller3579961k+Text Domain Mismatch
#1209Ni WooCommerce Sales Report35236256500Text Domain Mismatch
#1210ONet Regenerate Thumbnails35190641k+Text Domain Mismatch
#1211OPcache Manager35155751k+Output is not escaped
#1212Paybox WooCommerce Payment Gateway3516588500Non Singular String Literal Domain
#1213Paytm Payment Gateway35921043k+Missing Arg Domain
#1214Perfecty Push Notifications352042134k+SQL query is not prepared
#1215Accept Cryptocurrencies with Plisio3537471k+Text Domain Mismatch
#1216Popular Posts3516671900Unsafe printing function
#1217Popup with fancybox351961681k+Unsafe printing function
#1218Post Draft Preview354969700Text Domain Mismatch
#1219ReactPress – Create React App for WordPress3526433k+Request data is not unslashed
#1220Recurio – Ultimate Subscription for WooCommerce35343041k+Direct Query
#1221Related Posts by Taxonomy351319710k+Output is not escaped
#1222Related Posts for WordPress3520718010k+Output is not escaped
#1223ReOrder Posts within Categories35392077k+Non-prefixed global variable
#1224WP Responsive Tabs horizontal vertical and accordion Tabs355982122k+Output is not escaped
#1225Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant3583762k+Output is not escaped
#1226Simple Image Sizes35537560k+Unsafe printing function
#1227Simple Yearly Archive35102366k+Unsafe printing function
#1228Social Sharing Plugin – Social Warfare351714320k+Non-prefixed class
#1229Spacious Toolkit354894700Non-prefixed global variable
#1230Spots3519549800Output is not escaped
#1231Stars Testimonials — Responsive Reviews & Star Ratings35292531k+Non-prefixed global variable
#1232Sticky Chat Widget – Floating Chat Icons, Contact Form, Call, Click to Chat, Email & Message Buttons353329310k+Non-prefixed global variable
#1233Subscribe to Unlock Lite – Opt In Content Locker Plugin for WordPress35106145500Non-prefixed global variable
#1234TBThemes Theme Import358448500Text Domain Mismatch
#1235Advance Product Search- Voice & Ajax Search for WooCommerce351259210k+Text Domain Mismatch
#1236The Courier Guy Shipping for WooCommerce35571073k+Missing nonce verification
#1237Two Factor Authentication3510813920k+Output is not escaped
#1238Uptime Robot Plugin for WordPress35398324600Text Domain Mismatch
#1239Video Grid352531061k+Output is not escaped
#1240Video Gallery35336178600Output is not escaped
#1241Void Elementor Post Grid Addon for Elementor Page builder35189933k+Text Domain Mismatch
#1242W4 Post List35501383k+Non-prefixed global variable
#1243WC Cancel Order35521225k+Non-prefixed hook name
#1244Spreadconnect35128126700Output is not escaped
#1245WC Ukraine Shipping – Integration of Nova Poshta and Ukrposhta for WooCommerce355041647k+Text Domain Mismatch
#1246Webflow Pages3536632k+Non Singular String Literal Domain
#1247Wired Impact Volunteer Management352531751k+Output is not escaped
#1248Backend Payments for WooCommerce3563421k+Exception output is not escaped
#1249DPD Baltic Shipping35912022k+Text Domain Mismatch
#1250WP Associate Post R235259863k+Output is not escaped