PluginScore

WordPress.DB.PreparedSQL.NotPrepared

SQL query is not prepared

A database query includes dynamic data without using `$wpdb->prepare()` or an equivalent safe pattern.

critical weight

Why It Shows Up

The scan found a SQL string passed to `$wpdb` where variables appear to be interpolated or concatenated directly.

Why It Matters

Unprepared SQL can allow SQL injection when user-controlled values reach the query.

How to Fix

  • Move dynamic values into placeholders such as `%s`, `%d`, `%f`, or `%i` where supported.
  • Pass the values as separate arguments to `$wpdb->prepare()`.
  • For table names, column names, and sort directions, use strict allowlists instead of raw user input.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#101Wordfence Security – Firewall, Malware Scan, and Login Security211,5922,9735m+Output is not escaped
#102WP Compress – Instant Performance & Speed Optimization213,3673,25310k+Non Singular String Literal Domain
#103WP-Lister Lite for eBay216,6975,1292k+Output is not escaped
#104WP phpMyAdmin214,5286,43550k+Missing Arg Domain
#105wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin211,8111,43270k+Output is not escaped
#106WP Extended – The Ultimate WordPress Toolkit211,253398600Non Singular String Literal Domain
#107WPScan – WordPress Security Scanner215272658k+Text Domain Mismatch
#108WebTotem Security211,110213900Text Domain Mismatch
#10912 Step Meeting List22156593900Non-prefixed global variable
#110WP Sessions Time Monitoring Full Automatic228691,529500Non-prefixed global variable
#111Advanced Classifieds & Directory Pro221,2293,5112k+Non-prefixed global variable
#112Advanced Form Integration — Connect Forms to 200+ Apps225,7784,68310k+wp function not compatible with requires wp
#113All-in-One Video Gallery229112,89220k+Non-prefixed global variable
#114Knowledge Base documentation & wiki plugin – BasePress Docs226711,7672k+Non-prefixed global variable
#115Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots221,6072,02010k+Direct Query
#116Cart Lift – Abandoned Cart Recovery for WooCommerce and EDD226697691k+Output is not escaped
#117Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer222,8581,27050k+Text Domain Mismatch
#118Accept PayPal Payments using Contact Form 722359127600Text Domain Mismatch
#119RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login223,6535,0788k+Non-prefixed global variable
#120Data Tables Generator by Supsystic2215815210k+Exception output is not escaped
#121Directorist: AI-Powered Business Directory, Listings & Classified Ads225492,17520k+Non-prefixed global variable
#122DirectoryPress – Business Directory And Classified Ad Listing224,7872,795800Text Domain Mismatch
#123Download Manager222,5131,462100k+Output is not escaped
#124Dynamic QR Code – generator222382086k+Missing direct file access protection
#125E2Pdf – Export Pdf Tool for WordPress221,07583610k+Unsafe printing function
#126Easy Social Feed – Social Photos Gallery and Post Feed for WordPress221,5671,27730k+Non-prefixed global variable
#127easyReservations225,3072,480800Text Domain Mismatch
#128Employee Spotlight – Team Member Showcase & Meet the Team Plugin22247689400Non-prefixed hook name
#129Estatik Real Estate Plugin223,04932510k+Text Domain Mismatch
#130Events Maker by dFactory225888191k+Output is not escaped
#131Events Manager – Calendar, Bookings, Tickets, and more!224,7135,66070k+Output is not escaped
#132FACTO – Facturación Electrónica22242432400Request data is not unslashed
#133Falang multilanguage for WordPress227167691k+Output is not escaped
#134Finale Lite – Sales Countdown Timer & Discount for WooCommerce221,0314514k+Output is not escaped
#135FireBox Popups – Increase Sales and Grow Your Email List221538127k+Non-prefixed global variable
#136Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder22409236700k+Text Domain Mismatch
#137Five Star Restaurant Menu and Food Ordering227526095k+Output is not escaped
#138GeoDirectory – WP Business Directory Plugin and Classified Listings Directory224,4663,97210k+Output is not escaped
#139Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms221,03772220k+Unsafe printing function
#140Hesabfa Accounting22467718400Text Domain Mismatch
#141History Log by click5226751,290400Direct Query
#142Csomagpontok és Címkék WooCommerce-hez222,0017697k+Text Domain Mismatch
#143IMPress for IDX Broker221,0856366k+Text Domain Mismatch
#144The Innovative Form Builder – IvyForms22713250400Exception output is not escaped
#145InfiniteWP Client222,2861,812200k+Exception output is not escaped
#146Import WP – Export and Import CSV and XML files to WordPress225803304k+Exception output is not escaped
#147LearnPress – WordPress LMS Plugin for Create and Sell Online Courses222,3463,34170k+Non-prefixed global variable
#148Mail Baby SMTP22385699600SQL query is not prepared
#149MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.222,6252,45810k+Output is not escaped
#150Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider22207323500k+Non-prefixed global variable