WordPress.DB.PreparedSQL.NotPrepared
SQL query is not prepared
A database query includes dynamic data without using `$wpdb->prepare()` or an equivalent safe pattern.
Why It Shows Up
The scan found a SQL string passed to `$wpdb` where variables appear to be interpolated or concatenated directly.
Why It Matters
Unprepared SQL can allow SQL injection when user-controlled values reach the query.
How to Fix
- Move dynamic values into placeholders such as `%s`, `%d`, `%f`, or `%i` where supported.
- Pass the values as separate arguments to `$wpdb->prepare()`.
- For table names, column names, and sort directions, use strict allowlists instead of raw user input.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #1701 | Customize Snapshots | 43 | 9 | 42 | 500 | Nonce verification recommended | ||
| #1702 | F4 Total Stock Value for WooCommerce | 43 | 27 | 12 | 1k+ | Output is not escaped | ||
| #1703 | Post title marquee scroll | 43 | 43 | 25 | 1k+ | Output is not escaped | ||
| #1704 | Qodax Checkout Manager – Checkout Field Editor for WooCommerce | 43 | 17 | 27 | 400 | Interpolated SQL is not prepared | ||
| #1705 | Secure Passkeys | 43 | 145 | 83 | 1k+ | Exception output is not escaped | ||
| #1706 | Term Management Tools | 43 | 9 | 26 | 10k+ | Non-prefixed hook name | ||
| #1707 | Terms Order WP – Categories And Taxonomies Order Plugin | 43 | 12 | 47 | 800 | Non-prefixed global variable | ||
| #1708 | WP Hotel Booking WPML Support | 43 | 10 | 52 | 400 | Direct Query | ||
| #1709 | WP Mail Log | 43 | 40 | 29 | 10k+ | Text Domain Mismatch | ||
| #1710 | Debug Bar Console | 44 | 23 | 9 | 1k+ | Missing Arg Domain | ||
| #1711 | DoLogin Security | 44 | 74 | 4 | 7k+ | Exception output is not escaped | ||
| #1712 | EasyFonts – Host Google Fonts Locally, Fast & Auto-Optimize, GDPR Compliant | 44 | 5 | 70 | 1k+ | Interpolated SQL is not prepared | ||
| #1713 | Github Embed | 44 | 18 | 35 | 1k+ | Non-prefixed global variable | ||
| #1714 | I Order Terms | 44 | 40 | 24 | 1k+ | Output is not escaped | ||
| #1715 | Extended Post Status | 45 | 27 | 27 | 1k+ | Output is not escaped | ||
| #1716 | Inazo's flamingo automatically delete old messages | 45 | 33 | 20 | 4k+ | Output is not escaped | ||
| #1717 | Super Blank | 45 | 131 | 56 | 9k+ | Missing direct file access protection | ||
| #1718 | SureDonation – Donation Forms, Fundraising Campaigns & Donor Management | 45 | 44 | 76 | 2k+ | Missing Arg Domain | ||
| #1719 | Display Featured Image for Genesis | 46 | 64 | 59 | 1k+ | Non-prefixed global variable | ||
| #1720 | Gravity Forms Constant Contact | 46 | 36 | 27 | 3k+ | Non-prefixed class | ||
| #1721 | SX User Name Security | 46 | 42 | 9 | 900 | Output is not escaped | ||
| #1722 | Auto Focus Keyword for SEO | 47 | 13 | 44 | 2k+ | Interpolated SQL is not prepared | ||
| #1723 | Delete Duplicate Posts | 47 | 9 | 50 | 10k+ | Direct Query | ||
| #1724 | DPO Pay for WooCommerce | 47 | 28 | 41 | 1k+ | Non Singular String Literal Text | ||
| #1725 | Log Emails | 47 | 19 | 29 | 6k+ | Non-prefixed global variable | ||
| #1726 | FlexStock – Product Stock Sync with Google Sheets for WooCommerce | 47 | 5 | 255 | 700 | Direct Query | ||
| #1727 | Userback | 47 | 13 | 20 | 2k+ | Output is not escaped | ||
| #1728 | Website Article Monetization By MageNet | 47 | 17 | 24 | 10k+ | Output is not escaped | ||
| #1729 | FedaPay Gateway for WooCommerce | 47 | 24 | 11 | 700 | Output is not escaped | ||
| #1730 | WP Prefix Changer | 47 | 27 | 16 | 900 | Missing Arg Domain | ||
| #1731 | Compress, Resize & Lazy Load Images – WPvivid Image Optimization | 47 | 107 | 58 | 10k+ | Missing direct file access protection | ||
| #1732 | Comment Notifier | 48 | 10 | 55 | 400 | Non-prefixed global variable | ||
| #1733 | Legal Pages – Privacy Policy, Terms & Conditions, GDPR, CCPA, and Cookie Notice Generator | 48 | 43 | 83 | 9k+ | Missing direct file access protection | ||
| #1734 | Easy Updates Manager | 48 | 13 | 182 | 300k+ | Non-prefixed global variable | ||
| #1735 | WS Action Scheduler Cleaner | 48 | 13 | 80 | 3k+ | error log error log | ||
| #1736 | SiteEase Bulk Delete Manager | 49 | 50 | 72 | 600 | Direct Query | ||
| #1737 | CIO Custom Fields Importer | 49 | 23 | 8 | 400 | Output is not escaped | ||
| #1738 | Import into Easy Property Listings | 49 | 335 | 24 | 1k+ | Text Domain Mismatch | ||
| #1739 | Anti-Spam Protection – No API Key, GDPR Friendly | 49 | 2 | 106 | 1k+ | Direct Query | ||
| #1740 | Plugins Last Updated Column | 49 | 21 | 14 | 600 | Output is not escaped | ||
| #1741 | ReCrawler | 49 | 10 | 40 | 4k+ | Direct Query | ||
| #1742 | Search in Place | 49 | 74 | 57 | 3k+ | wp function not compatible with requires wp | ||
| #1743 | SKT Themes Demo Import | 49 | 218 | 104 | 4k+ | Text Domain Mismatch | ||
| #1744 | WP Sitemap Page | 49 | 43 | 14 | 200k+ | Missing Translators Comment | ||
| #1745 | MB Custom Post Types & Custom Taxonomies | 50 | 61 | 55 | 10k+ | Missing Translators Comment | ||
| #1746 | Theme Demo Import | 50 | 101 | 95 | 5k+ | Non-prefixed hook name | ||
| #1747 | WPML Multilingual for BuddyPress and BuddyBoss | 51 | 18 | 21 | 6k+ | SQL query is not prepared | ||
| #1748 | Lite Video Embed | 51 | 35 | 7 | 1k+ | Output is not escaped | ||
| #1749 | OnSale Page for WooCommerce | 51 | 30 | 44 | 2k+ | Text Domain Mismatch | ||
| #1750 | Popular Brand Icons – Simple Icons | 51 | 20 | 12 | 3k+ | Output is not escaped |
