WordPress.DB.PreparedSQL.NotPrepared
SQL query is not prepared
A database query includes dynamic data without using `$wpdb->prepare()` or an equivalent safe pattern.
Why It Shows Up
The scan found a SQL string passed to `$wpdb` where variables appear to be interpolated or concatenated directly.
Why It Matters
Unprepared SQL can allow SQL injection when user-controlled values reach the query.
How to Fix
- Move dynamic values into placeholders such as `%s`, `%d`, `%f`, or `%i` where supported.
- Pass the values as separate arguments to `$wpdb->prepare()`.
- For table names, column names, and sort directions, use strict allowlists instead of raw user input.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #1551 | WP-DraftsForFriends | 38 | 141 | 71 | 1k+ | Output is not escaped | ||
| #1552 | WP Media Categories | 38 | 40 | 103 | 800 | Nonce verification recommended | ||
| #1553 | Native PHP Sessions | 38 | 30 | 92 | 10k+ | Direct Query | ||
| #1554 | Real-Time Post Statistics for WordPress | 38 | 63 | 68 | 2k+ | SQL query is not prepared | ||
| #1555 | Responsive Vertical Icon Menu | 38 | 188 | 85 | 700 | Output is not escaped | ||
| #1556 | ZeroBounce Email Verification & Validation | 38 | 299 | 162 | 1k+ | Text Domain Mismatch | ||
| #1557 | Ad Invalid Click Protector (AICP) | 39 | 78 | 57 | 10k+ | Text Domain Mismatch | ||
| #1558 | Add-on Gravity Forms – MailPoet 3 | 39 | 31 | 33 | 600 | Output is not escaped | ||
| #1559 | Advanced Woo Labels – Product Labels & Badges for WooCommerce | 39 | 173 | 125 | 10k+ | Output is not escaped | ||
| #1560 | bbPress Moderation | 39 | 75 | 15 | 500 | Non Singular String Literal Domain | ||
| #1561 | Better Random Redirect | 39 | 88 | 40 | 700 | Text Domain Mismatch | ||
| #1562 | Better User Search | 39 | 24 | 44 | 700 | SQL query is not prepared | ||
| #1563 | Bulk Auto Image Alt Text (Alt tag, Alt attribute) optimizer (image SEO) | 39 | 16 | 47 | 10k+ | Request data is not unslashed | ||
| #1564 | Calculator Builder – Create an Online Calculator | 39 | 16 | 221 | 1k+ | Non-prefixed global variable | ||
| #1565 | CatFolders Document Gallery & PDF Library | 39 | 66 | 32 | 3k+ | Output is not escaped | ||
| #1566 | Constant Contact + WooCommerce | 39 | 27 | 91 | 1k+ | Nonce verification recommended | ||
| #1567 | Image CAPTCHA for Contact Form 7 and WPForms by HookAndHook (DSGVO/GDPR) | 39 | 28 | 45 | 80k+ | Missing nonce verification | ||
| #1568 | Custom Post Type Auto Menu | 39 | 54 | 33 | 500 | Text Domain Mismatch | ||
| #1569 | Drip for Gravity Forms | 39 | 41 | 21 | 500 | Unsafe printing function | ||
| #1570 | Duplicate Killer – Prevent Duplicate Form Submissions | 39 | 57 | 103 | 1k+ | Non-prefixed global variable | ||
| #1571 | Email Marketing by EmailOctopus | 39 | 43 | 62 | 3k+ | Non-prefixed global variable | ||
| #1572 | Favorites | 39 | 187 | 123 | 10k+ | Unsafe printing function | ||
| #1573 | First Order Discount Woocommerce | 39 | 55 | 30 | 1k+ | Output is not escaped | ||
| #1574 | Fix Duplicates | 39 | 76 | 73 | 800 | Output is not escaped | ||
| #1575 | Flamix: Bitrix24 and WooCommerce Orders integration | 39 | 81 | 31 | 500 | Output is not escaped | ||
| #1576 | Gallery Widget | 39 | 122 | 11 | 500 | Output is not escaped | ||
| #1577 | Maintenance Mode | 39 | 86 | 109 | 7k+ | Output is not escaped | ||
| #1578 | Improved Save Button | 39 | 44 | 52 | 4k+ | Missing Translators Comment | ||
| #1579 | Insert Html Snippet | 39 | 159 | 205 | 20k+ | Output is not escaped | ||
| #1580 | JJ NextGen JQuery Carousel | 39 | 122 | 9 | 400 | Output is not escaped | ||
| #1581 | JJ NextGen JQuery Slider | 39 | 221 | 7 | 800 | Output is not escaped | ||
| #1582 | Mail Subscribe List | 39 | 17 | 94 | 3k+ | Input is not validated | ||
| #1583 | Markup by Attribute for WooCommerce | 39 | 46 | 102 | 2k+ | Direct Query | ||
| #1584 | Menubar | 39 | 171 | 46 | 1k+ | Output is not escaped | ||
| #1585 | Paystack Add-On for Gravity Forms | 39 | 96 | 31 | 400 | Text Domain Mismatch | ||
| #1586 | Quform Mailchimp | 39 | 65 | 147 | 800 | Nonce verification recommended | ||
| #1587 | Quform Zapier | 39 | 60 | 123 | 1k+ | Nonce verification recommended | ||
| #1588 | Redirect 404 Error Page to Homepage or Custom Page with Logs | 39 | 27 | 53 | 10k+ | Nonce verification recommended | ||
| #1589 | Re Gallery – Responsive Image & Photo Gallery | 39 | 16 | 121 | 700 | Missing nonce verification | ||
| #1590 | Reorder by Term | 39 | 20 | 84 | 1k+ | Request data is not unslashed | ||
| #1591 | Responsify WP | 39 | 90 | 11 | 600 | Unsafe printing function | ||
| #1592 | Serial Number for Contact Form 7 | 39 | 105 | 53 | 2k+ | Non Singular String Literal Domain | ||
| #1593 | Shared Files – File Upload & Download Manager | 39 | 5 | 184 | 4k+ | Nonce verification recommended | ||
| #1594 | Shipping Simulator for WooCommerce | 39 | 120 | 39 | 5k+ | Text Domain Mismatch | ||
| #1595 | Simple Membership WP user Import | 39 | 22 | 46 | 4k+ | Request data is not unslashed | ||
| #1596 | Easy Category Icons | 39 | 50 | 43 | 600 | Text Domain Mismatch | ||
| #1597 | ThemeKit For WordPress | 39 | 149 | 49 | 700 | Output is not escaped | ||
| #1598 | Traffic Monitor | 39 | 6 | 143 | 1k+ | Direct Query | ||
| #1599 | Accessibility by UserWay | 39 | 22 | 35 | 80k+ | Direct Query | ||
| #1600 | Smart COD for WooCommerce | 39 | 50 | 28 | 30k+ | Output is not escaped |
