WordPress.DB.PreparedSQL.NotPrepared
SQL query is not prepared
A database query includes dynamic data without using `$wpdb->prepare()` or an equivalent safe pattern.
Why It Shows Up
The scan found a SQL string passed to `$wpdb` where variables appear to be interpolated or concatenated directly.
Why It Matters
Unprepared SQL can allow SQL injection when user-controlled values reach the query.
How to Fix
- Move dynamic values into placeholders such as `%s`, `%d`, `%f`, or `%i` where supported.
- Pass the values as separate arguments to `$wpdb->prepare()`.
- For table names, column names, and sort directions, use strict allowlists instead of raw user input.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #1701 | Custom Fields for Gutenberg | 42 | 24 | 24 | 1k+ | Output is not escaped | ||
| #1702 | Delete Expired Transients | 42 | 49 | 65 | 5k+ | Direct Query | ||
| #1703 | Exclude Pages | 42 | 31 | 14 | 30k+ | Non Singular String Literal Domain | ||
| #1704 | Geo Blocker – Control Site Access by Region and IP | 42 | 10 | 64 | 900 | Direct Query | ||
| #1705 | Hide Cart Functions | 42 | 12 | 50 | 3k+ | Nonce verification recommended | ||
| #1706 | LeadSnap | 42 | 14 | 84 | 1k+ | Input is not validated | ||
| #1707 | Manage User Columns | 42 | 15 | 27 | 1k+ | Request data is not unslashed | ||
| #1708 | Mass Delete Unused Tags | 42 | 21 | 9 | 900 | Output is not escaped | ||
| #1709 | Republish Old Posts | 42 | 83 | 24 | 2k+ | Output is not escaped | ||
| #1710 | Secure Passkeys | 42 | 146 | 76 | 1k+ | Exception output is not escaped | ||
| #1711 | Sendcloud Shipping | 42 | 78 | 56 | 5k+ | Output is not escaped | ||
| #1712 | Set All First Images As Featured | 42 | 44 | 13 | 700 | Text Domain Mismatch | ||
| #1713 | Speed Contact Bar | 42 | 53 | 20 | 5k+ | Output is not escaped | ||
| #1714 | Transients Manager | 42 | 45 | 50 | 20k+ | Output is not escaped | ||
| #1715 | WC Price History | 42 | 18 | 21 | 4k+ | Database parameter is not escaped | ||
| #1716 | Auto Coupons for WooCommerce | 42 | 81 | 68 | 4k+ | Output is not escaped | ||
| #1717 | WP Author Security | 42 | 40 | 13 | 500 | Output is not escaped | ||
| #1718 | Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) | 42 | 2,583 | 1,823 | 10k+ | Text Domain Mismatch | ||
| #1719 | WP Fingerprint | 42 | 34 | 47 | 9k+ | Direct Query | ||
| #1720 | WP Mail Log | 42 | 42 | 29 | 10k+ | Text Domain Mismatch | ||
| #1721 | Auto Alt Text | 43 | 52 | 13 | 4k+ | Exception output is not escaped | ||
| #1722 | Customize Snapshots | 43 | 9 | 42 | 500 | Nonce verification recommended | ||
| #1723 | F4 Total Stock Value for WooCommerce | 43 | 27 | 12 | 1k+ | Output is not escaped | ||
| #1724 | Live Copy Paste for Elementor – Cross Domain Copy Paste & Page Duplicator | 43 | 12 | 32 | 7k+ | Request data is not unslashed | ||
| #1725 | Post title marquee scroll | 43 | 43 | 25 | 1k+ | Output is not escaped | ||
| #1726 | Qodax Checkout Manager – Checkout Field Editor for WooCommerce | 43 | 17 | 27 | 400 | Interpolated SQL is not prepared | ||
| #1727 | SQL Chart Builder | 43 | 12 | 39 | 600 | Non-prefixed global variable | ||
| #1728 | Term Management Tools | 43 | 9 | 26 | 10k+ | Non-prefixed hook name | ||
| #1729 | Terms Order WP – Categories And Taxonomies Order Plugin | 43 | 12 | 47 | 900 | Non-prefixed global variable | ||
| #1730 | Ultimate Member Widgets for Elementor – Login Form, Register Form & User Directory | 43 | 15 | 102 | 400 | Non-prefixed namespace | ||
| #1731 | User Role Editor | 43 | 117 | 145 | 700k+ | Output is not escaped | ||
| #1732 | WP Hotel Booking WPML Support | 43 | 10 | 52 | 400 | Direct Query | ||
| #1733 | Debug Bar Console | 44 | 23 | 9 | 1k+ | Missing Arg Domain | ||
| #1734 | Github Embed | 44 | 18 | 35 | 1k+ | Non-prefixed global variable | ||
| #1735 | I Order Terms | 44 | 40 | 24 | 1k+ | Output is not escaped | ||
| #1736 | Back In Stock Notifier for WooCommerce | WooCommerce Waitlist Pro | 45 | 26 | 117 | 20k+ | Non-prefixed hook name | ||
| #1737 | Extended Post Status | 45 | 27 | 27 | 1k+ | Output is not escaped | ||
| #1738 | Inazo's flamingo automatically delete old messages | 45 | 33 | 20 | 4k+ | Output is not escaped | ||
| #1739 | Super Blank | 45 | 131 | 56 | 10k+ | Missing direct file access protection | ||
| #1740 | Display Featured Image for Genesis | 46 | 64 | 59 | 1k+ | Non-prefixed global variable | ||
| #1741 | Gravity Forms Constant Contact | 46 | 36 | 27 | 3k+ | Non-prefixed class | ||
| #1742 | Podcast Player – Your Podcasting Companion | 46 | 14 | 133 | 10k+ | Non-prefixed global variable | ||
| #1743 | SX User Name Security | 46 | 42 | 9 | 900 | Output is not escaped | ||
| #1744 | Delete Duplicate Posts | 47 | 9 | 50 | 10k+ | Direct Query | ||
| #1745 | DPO Pay for WooCommerce | 47 | 28 | 41 | 1k+ | Non Singular String Literal Text | ||
| #1746 | EasyFonts – Host Google Fonts Locally, Fast & Auto-Optimize, GDPR Compliant | 47 | 5 | 58 | 1k+ | Interpolated SQL is not prepared | ||
| #1747 | Legal Pages – Privacy Policy, Terms & Conditions, GDPR, CCPA, and Cookie Notice Generator | 47 | 44 | 83 | 10k+ | Missing direct file access protection | ||
| #1748 | Log Emails | 47 | 19 | 29 | 6k+ | Non-prefixed global variable | ||
| #1749 | Userback | 47 | 13 | 20 | 2k+ | Output is not escaped | ||
| #1750 | Website Article Monetization By MageNet | 47 | 17 | 24 | 10k+ | Output is not escaped |
