WordPress.DB.PreparedSQL.NotPrepared
SQL query is not prepared
A database query includes dynamic data without using `$wpdb->prepare()` or an equivalent safe pattern.
Why It Shows Up
The scan found a SQL string passed to `$wpdb` where variables appear to be interpolated or concatenated directly.
Why It Matters
Unprepared SQL can allow SQL injection when user-controlled values reach the query.
How to Fix
- Move dynamic values into placeholders such as `%s`, `%d`, `%f`, or `%i` where supported.
- Pass the values as separate arguments to `$wpdb->prepare()`.
- For table names, column names, and sort directions, use strict allowlists instead of raw user input.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #1751 | YayMail – WooCommerce Email Customizer | 51 | 163 | 788 | 50k+ | Non-prefixed global variable | ||
| #1752 | Disable Comments – Remove Comments & Stop Spam [Multi-Site Support] | 52 | 17 | 57 | 1m+ | Non-prefixed global variable | ||
| #1753 | Post Notification by Email | 52 | 36 | 13 | 1k+ | Output is not escaped | ||
| #1754 | SKU Generator for WooCommerce | 52 | 29 | 12 | 2k+ | Output is not escaped | ||
| #1755 | Stealth Publish | 52 | 7 | 22 | 900 | Missing nonce verification | ||
| #1756 | Maps Plugin using Google Maps for WordPress – WP Google Map | 53 | 6 | 43 | 10k+ | Missing nonce verification | ||
| #1757 | LearnPress – bbPress Integration | 53 | 19 | 14 | 2k+ | Output is not escaped | ||
| #1758 | Customizable Post Listings | 54 | 42 | 13 | 700 | Deprecated parameter: the_author parameter 1 | ||
| #1759 | Cyr-To-Lat | 54 | 16 | 48 | 300k+ | Dynamic hook name | ||
| #1760 | Expanding Archives | 54 | 37 | 9 | 3k+ | Output is not escaped | ||
| #1761 | Extended User Search In WP-Admin | 54 | 14 | 17 | 900 | SQL query is not prepared | ||
| #1762 | Helpie FAQ — Accordion, Docs & Knowledge Base | 54 | 96 | 89 | 9k+ | Nonce verification recommended | ||
| #1763 | MOBILOOK — Mobile View & Mobile‑Friendly Test | 54 | 8 | 20 | 1k+ | Missing nonce verification | ||
| #1764 | AI Agent by SiteGround | 54 | 28 | 6 | 1m+ | Exception output is not escaped | ||
| #1765 | Easy Quotes | 55 | 11 | 31 | 700 | Direct Query | ||
| #1766 | Enhanced Category Pages | 55 | 23 | 25 | 2k+ | Direct Query | ||
| #1767 | Go Live Update Urls | 55 | 11 | 49 | 90k+ | Non-prefixed hook name | ||
| #1768 | Fast Page & Post Duplicator | 55 | 12 | 25 | 50k+ | Direct Query | ||
| #1769 | AI Copilot – ChatGPT Chatbot & AI Engine for Post Automation | 56 | 65 | 20 | 1k+ | Text Domain Mismatch | ||
| #1770 | Replace Protected Password | 56 | 6 | 18 | 600 | Input is not sanitized | ||
| #1771 | Internal Link Juicer: SEO Auto Linker for WordPress | 57 | 12 | 61 | 90k+ | Database parameter is not escaped | ||
| #1772 | iZooto – Web Push Notifications | 57 | 26 | 25 | 1k+ | wp function not compatible with requires wp | ||
| #1773 | Longer Permalinks | 57 | 27 | 21 | 8k+ | Missing Arg Domain | ||
| #1774 | Ultimate Member – Terms & Conditions | 57 | 19 | 9 | 4k+ | Output is not escaped | ||
| #1775 | Filter Orders by Product for WooCommerce | 57 | 9 | 21 | 4k+ | Nonce verification recommended | ||
| #1776 | BCM Duplicate Menu | 58 | 8 | 11 | 4k+ | Nonce verification recommended | ||
| #1777 | HAL | 58 | 106 | 24 | 500 | Text Domain Mismatch | ||
| #1778 | Age Gator | 59 | 9 | 15 | 400 | Direct Query | ||
| #1779 | Custom API for WP | 59 | 173 | 16 | 1k+ | wp function not compatible with requires wp | ||
| #1780 | Live Copy Paste for Elementor – Cross Domain Copy Paste & Page Duplicator | 59 | 8 | 14 | 6k+ | Missing direct file access protection | ||
| #1781 | Leadpages | 60 | 4 | 53 | 10k+ | Direct Query | ||
| #1782 | WPB Popup for Contact Form 7 – Showing Contact Form 7 Popup on Button Click | 60 | 22 | 9 | 6k+ | Output is not escaped | ||
| #1783 | WPSSO Schema Product Metadata for WooCommerce | 60 | 33 | 23 | 500 | Missing Translators Comment | ||
| #1784 | PW WooCommerce Copy Coupon | 61 | 15 | 17 | 1k+ | Text Domain Mismatch | ||
| #1785 | AAM Protected Media Files | 62 | 13 | 10 | 600 | Direct Query | ||
| #1786 | Add Meta Tag Keywords | 62 | 6 | 15 | 1k+ | Missing nonce verification | ||
| #1787 | Contact Form 7 – Blacklist Unwanted Email | 62 | 16 | 11 | 400 | Missing direct file access protection | ||
| #1788 | FluentPlayer – Video Player With Forms & Lead Capture | 62 | 24 | 42 | 1k+ | Missing Translators Comment | ||
| #1789 | Import entries for Gravity Forms | 62 | 6 | 26 | 600 | Input is not validated | ||
| #1790 | Woo Product Remover | 62 | 23 | 14 | 1k+ | SQL query is not prepared | ||
| #1791 | WP Category Sort | 62 | 15 | 22 | 500 | Text Domain Mismatch | ||
| #1792 | Automatic Featured Images from Videos | 63 | 13 | 13 | 7k+ | Missing direct file access protection | ||
| #1793 | IndexNow Plugin | 63 | 14 | 91 | 100k+ | error log error log | ||
| #1794 | MooWoodle – WordPress Moodle LMS Integration, Sell Moodle Courses via WooCommerce | 63 | 10 | 45 | 800 | No Caching | ||
| #1795 | Hide Posts | 63 | 8 | 64 | 20k+ | Direct Query | ||
| #1796 | Collapsing Archives | 64 | 36 | 9 | 3k+ | date date | ||
| #1797 | JTL-Connector for WooCommerce | 64 | 7 | 166 | 1k+ | Direct Query | ||
| #1798 | Email Tracker | 65 | 25 | 4 | 800 | SQL query is not prepared | ||
| #1799 | Bitrix24 | 65 | 28 | 10 | 600 | Text Domain Mismatch | ||
| #1800 | SQL Buddy – Database Management Made Easy | 65 | 12 | 16 | 5k+ | SQL query is not prepared |
