WordPress.DB.PreparedSQL.NotPrepared
SQL query is not prepared
A database query includes dynamic data without using `$wpdb->prepare()` or an equivalent safe pattern.
Why It Shows Up
The scan found a SQL string passed to `$wpdb` where variables appear to be interpolated or concatenated directly.
Why It Matters
Unprepared SQL can allow SQL injection when user-controlled values reach the query.
How to Fix
- Move dynamic values into placeholders such as `%s`, `%d`, `%f`, or `%i` where supported.
- Pass the values as separate arguments to `$wpdb->prepare()`.
- For table names, column names, and sort directions, use strict allowlists instead of raw user input.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #1301 | Sticky Chat Widget – Floating Chat Icons, Contact Form, Call, Click to Chat, Email & Message Buttons | 35 | 33 | 293 | 10k+ | Non-prefixed global variable | ||
| #1302 | Subscribe to Unlock Lite – Opt In Content Locker Plugin for WordPress | 35 | 106 | 145 | 500 | Non-prefixed global variable | ||
| #1303 | Tapfiliate | 35 | 35 | 49 | 400 | Nonce verification recommended | ||
| #1304 | TBThemes Theme Import | 35 | 84 | 48 | 500 | Text Domain Mismatch | ||
| #1305 | Advance Product Search- Voice & Ajax Search for WooCommerce | 35 | 125 | 92 | 10k+ | Text Domain Mismatch | ||
| #1306 | The Courier Guy Shipping for WooCommerce | 35 | 57 | 107 | 3k+ | Missing nonce verification | ||
| #1307 | Two Factor Authentication | 35 | 108 | 139 | 20k+ | Output is not escaped | ||
| #1308 | Uptime Robot Plugin for WordPress | 35 | 398 | 324 | 600 | Text Domain Mismatch | ||
| #1309 | Video Grid | 35 | 253 | 106 | 1k+ | Output is not escaped | ||
| #1310 | Video Gallery | 35 | 336 | 178 | 600 | Output is not escaped | ||
| #1311 | Void Elementor Post Grid Addon for Elementor Page builder | 35 | 189 | 93 | 3k+ | Text Domain Mismatch | ||
| #1312 | W4 Post List | 35 | 50 | 138 | 3k+ | Non-prefixed global variable | ||
| #1313 | WC Cancel Order | 35 | 52 | 122 | 5k+ | Non-prefixed hook name | ||
| #1314 | Spreadconnect | 35 | 128 | 126 | 700 | Output is not escaped | ||
| #1315 | WC Ukraine Shipping – Integration of Nova Poshta and Ukrposhta for WooCommerce | 35 | 504 | 164 | 7k+ | Text Domain Mismatch | ||
| #1316 | Webflow Pages | 35 | 36 | 63 | 2k+ | Non Singular String Literal Domain | ||
| #1317 | Wired Impact Volunteer Management | 35 | 253 | 175 | 1k+ | Output is not escaped | ||
| #1318 | Backend Payments for WooCommerce | 35 | 63 | 42 | 900 | Exception output is not escaped | ||
| #1319 | DPD Baltic Shipping | 35 | 91 | 202 | 2k+ | Text Domain Mismatch | ||
| #1320 | WP Associate Post R2 | 35 | 259 | 86 | 3k+ | Output is not escaped | ||
| #1321 | WP Cassify | 35 | 106 | 143 | 800 | Missing nonce verification | ||
| #1322 | WP Datepicker | 35 | 225 | 181 | 7k+ | Output is not escaped | ||
| #1323 | WP GPX Maps | 35 | 27 | 100 | 4k+ | Non-prefixed global variable | ||
| #1324 | Mail logging – WP Mail Catcher | 35 | 232 | 157 | 20k+ | Text Domain Mismatch | ||
| #1325 | WP Open Street Map | 35 | 59 | 111 | 3k+ | Input is not validated | ||
| #1326 | WP-Persian | 35 | 144 | 37 | 7k+ | Unsafe printing function | ||
| #1327 | WP All Import – Property Import for WP Residence | 35 | 41 | 32 | 700 | Output is not escaped | ||
| #1328 | video carousel slider with lightbox | 35 | 350 | 136 | 1k+ | Output is not escaped | ||
| #1329 | Integration for WooCommerce and QuickBooks | 35 | 263 | 125 | 1k+ | Output is not escaped | ||
| #1330 | WPCore Plugin Manager | 35 | 118 | 38 | 10k+ | Text Domain Mismatch | ||
| #1331 | WP Views Counter | 35 | 81 | 42 | 2k+ | Output is not escaped | ||
| #1332 | WPFront User Role Editor | 35 | 333 | 578 | 30k+ | Output is not escaped | ||
| #1333 | wpLingua – Automatic translation – Translate and make website multilingual | 35 | 79 | 167 | 2k+ | Nonce verification recommended | ||
| #1334 | WPPerformanceTester | 35 | 94 | 44 | 1k+ | Output is not escaped | ||
| #1335 | WPZOOM Addons for Elementor – Starter Templates & Widgets | 35 | 160 | 130 | 20k+ | Output is not escaped | ||
| #1336 | WPZOOM Portfolio Lite – Filterable Portfolio Plugin | 35 | 42 | 92 | 20k+ | Non-prefixed global variable | ||
| #1337 | xili-tidy-tags | 35 | 224 | 157 | 1k+ | Output is not escaped | ||
| #1338 | Yabe Webfont – Use Custom Fonts, Google Fonts or Adobe Fonts | 35 | 48 | 114 | 5k+ | Non-prefixed hook name | ||
| #1339 | Yes/No Chart | 35 | 136 | 139 | 2k+ | Unsafe printing function | ||
| #1340 | Year Make Model Search for WooCommerce | 35 | 188 | 162 | 1k+ | Output is not escaped | ||
| #1341 | Embeds for YouTube | 35 | 255 | 307 | 10k+ | Non-prefixed global variable | ||
| #1342 | Product Labels For Woocommerce (Sale Badges) | 36 | 90 | 48 | 10k+ | Output is not escaped | ||
| #1343 | Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder | 36 | 3 | 321 | 10k+ | Nonce verification recommended | ||
| #1344 | Blaze Demo Importer | 36 | 101 | 94 | 8k+ | Output is not escaped | ||
| #1345 | BlockStrap Page Builder – Bootstrap Blocks | 36 | 81 | 89 | 2k+ | Missing direct file access protection | ||
| #1346 | BP Group Documents | 36 | 27 | 195 | 600 | Non-prefixed global variable | ||
| #1347 | BP Profile Search | 36 | 321 | 85 | 5k+ | Output is not escaped | ||
| #1348 | Better WordPress Recent Comments | 36 | 319 | 69 | 600 | Text Domain Mismatch | ||
| #1349 | Simple SEO | 36 | 164 | 113 | 10k+ | Non Singular String Literal Domain | ||
| #1350 | Multi Step for Contact Form 7 | 36 | 61 | 106 | 10k+ | Missing nonce verification |
