WordPress.DB.PreparedSQL.NotPrepared
SQL query is not prepared
A database query includes dynamic data without using `$wpdb->prepare()` or an equivalent safe pattern.
Why It Shows Up
The scan found a SQL string passed to `$wpdb` where variables appear to be interpolated or concatenated directly.
Why It Matters
Unprepared SQL can allow SQL injection when user-controlled values reach the query.
How to Fix
- Move dynamic values into placeholders such as `%s`, `%d`, `%f`, or `%i` where supported.
- Pass the values as separate arguments to `$wpdb->prepare()`.
- For table names, column names, and sort directions, use strict allowlists instead of raw user input.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #1801 | Missed Schedule Post Publisher | 67 | 11 | 10 | 6k+ | Output is not escaped | ||
| #1802 | Multilingual Forms for Fluent Forms with WPML | 67 | 52 | 16 | 1k+ | Text Domain Mismatch | ||
| #1803 | WebToffee WooCommerce Product Feeds – Google Shopping, Pinterest, TikTok Ads, & More | 67 | 178 | 2,894 | 2k+ | Non-prefixed hook name | ||
| #1804 | Member Swipe for BuddyPress | 68 | 9 | 13 | 500 | Missing direct file access protection | ||
| #1805 | Collapsing Categories | 68 | 29 | 8 | 4k+ | Missing direct file access protection | ||
| #1806 | Export media with selected content (by DKZR) | 68 | 10 | 14 | 40k+ | Direct Query | ||
| #1807 | Free Assets Library – Openverse/Pixabay 600+ Million Images | 68 | 44 | 36 | 4k+ | Text Domain Mismatch | ||
| #1808 | Hreflang Manager – Hreflang Implementation for International SEO | 68 | 21 | 15 | 8k+ | wp function not compatible with requires wp | ||
| #1809 | News Magazine X Core | 68 | 63 | 30 | 5k+ | Missing Translators Comment | ||
| #1810 | Thank You Page for WooCommerce | 68 | 6 | 27 | 10k+ | Non-prefixed global variable | ||
| #1811 | WP Sanitize Accented Uploads | 68 | 15 | 16 | 800 | Quoted Simple Placeholder | ||
| #1812 | Search by SKU for Woocommerce | 69 | 13 | 10 | 10k+ | Direct Query | ||
| #1813 | Portfolio Post Type | 70 | 7 | 11 | 40k+ | Nonce verification recommended | ||
| #1814 | Search and Replace | 70 | 7 | 9 | 10k+ | Input is not sanitized | ||
| #1815 | Simple Login Captcha | 70 | 20 | 19 | 10k+ | date date | ||
| #1816 | Export Users With Meta | 70 | 13 | 13 | 2k+ | Direct Query | ||
| #1817 | Starter Templates & Sites Pack by ThemeGrill | 72 | 28 | 51 | 70k+ | Non-prefixed hook name | ||
| #1818 | Permalinks Moved Permanently | 73 | 7 | 7 | 700 | Database parameter is not escaped | ||
| #1819 | Speed Optimizer – The All-In-One Performance-Boosting Plugin | 73 | 16 | 14 | 1m+ | SQL query is not prepared | ||
| #1820 | Comment Edit Core – Simple Comment Editing | 73 | 27 | 85 | 2k+ | Non-prefixed hook name | ||
| #1821 | Autoload Optimizer | 74 | 4 | 17 | 600 | Direct Query | ||
| #1822 | Bing URL Submissions Plugin | 74 | 10 | 38 | 40k+ | error log error log | ||
| #1823 | Duplicate Taxonomy Term | 74 | 9 | 5 | 2k+ | Nonce verification recommended | ||
| #1824 | Clear Cache Everywhere | 75 | 7 | 20 | 800 | Non-prefixed hook name | ||
| #1825 | Cognito Forms | 75 | 13 | 4 | 2k+ | wp function not compatible with requires wp | ||
| #1826 | WPSSO WP Sitemaps XML with News, Image, and Video Sitemap | 75 | 60 | 24 | 400 | Missing Translators Comment | ||
| #1827 | Addonify – WooCommerce Wishlist | 76 | 30 | 43 | 1k+ | Non-prefixed global variable | ||
| #1828 | FileBird Document Library | 76 | 23 | 13 | 5k+ | Text Domain Mismatch | ||
| #1829 | Category Order and Taxonomy Terms Order | 76 | 41 | 10 | 500k+ | wp function not compatible with requires wp | ||
| #1830 | UTM Event Tracker and Analytics, UTM Grabber | 76 | 2 | 19 | 900 | Interpolated SQL is not prepared | ||
| #1831 | Posts List | 77 | 11 | 15 | 7k+ | Non-prefixed hook name | ||
| #1832 | Recent Posts | 78 | 7 | 2 | 400 | Database parameter is not escaped | ||
| #1833 | Record of Consent Extension for Complianz | 78 | 4 | 12 | 600 | Direct Query | ||
| #1834 | Bulk Datetime Change | 79 | 7 | 22 | 6k+ | Non-prefixed global variable | ||
| #1835 | WP Social Ninja – Embed Social Feeds, User Reviews & Chat Widgets | 79 | 27 | 21 | 30k+ | Missing direct file access protection | ||
| #1836 | Media Library File Size | 80 | 3 | 15 | 6k+ | Nonce verification recommended | ||
| #1837 | Table Of Contents Block | 80 | 8 | 7 | 10k+ | file system operations mkdir | ||
| #1838 | MH Free Gifts for WooCommerce | 81 | 5 | 9 | 300 | Database parameter is not escaped | ||
| #1839 | Price Table Block | 81 | 15 | 16 | 800 | file system operations mkdir | ||
| #1840 | Toggle Content | 81 | 16 | 12 | 700 | file system operations mkdir | ||
| #1841 | Typing Text | 81 | 15 | 16 | 500 | file system operations mkdir | ||
| #1842 | Accordion Toggle | 82 | 17 | 11 | 2k+ | Non-prefixed class | ||
| #1843 | Parallax Slider Block | 82 | 15 | 12 | 900 | file system operations mkdir | ||
| #1844 | Floating Button – Easily Create Sticky, Fixed & Floating Buttons | 84 | 6 | 184 | 4k+ | Non-prefixed global variable | ||
| #1845 | Image Gallery Block | 84 | 7 | 10 | 3k+ | file system operations mkdir | ||
| #1846 | Auto Subpage Menu | 85 | 5 | 6 | 700 | Database parameter is not escaped | ||
| #1847 | GazChap's WooCommerce Auto Category Product Thumbnails | 85 | 4 | 8 | 1k+ | trademarked term | ||
| #1848 | Vanilla PDF Embed | 85 | 8 | 3 | 3k+ | parse url parse url | ||
| #1849 | Booktics – Appointment Booking Calendar for Service Businesses | 86 | 32 | 8 | 700 | wp function not compatible with requires wp | ||
| #1850 | WP Missed Schedule Posts | 87 | 7 | 9 | 10k+ | trademarked term |
