WordPress.DB.PreparedSQL.NotPrepared
SQL query is not prepared
A database query includes dynamic data without using `$wpdb->prepare()` or an equivalent safe pattern.
Why It Shows Up
The scan found a SQL string passed to `$wpdb` where variables appear to be interpolated or concatenated directly.
Why It Matters
Unprepared SQL can allow SQL injection when user-controlled values reach the query.
How to Fix
- Move dynamic values into placeholders such as `%s`, `%d`, `%f`, or `%i` where supported.
- Pass the values as separate arguments to `$wpdb->prepare()`.
- For table names, column names, and sort directions, use strict allowlists instead of raw user input.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #1851 | Flipbox | 89 | 7 | 12 | 2k+ | file system operations mkdir | ||
| #1852 | Countdown Block | 90 | 7 | 8 | 4k+ | file system operations mkdir | ||
| #1853 | Disable Revisions | 90 | 5 | 5 | 1k+ | Direct Query | ||
| #1854 | Featured Image Admin Thumb | 90 | 7 | 10 | 20k+ | Non-prefixed hook name | ||
| #1855 | HivePress Messages | 90 | 7 | 10 | 7k+ | Direct Query | ||
| #1856 | Progress Bars | 90 | 8 | 12 | 500 | file system operations mkdir | ||
| #1857 | Image Slider Block | 90 | 7 | 10 | 3k+ | Non-prefixed class | ||
| #1858 | Team Member Block | 90 | 8 | 12 | 1k+ | file system operations mkdir | ||
| #1859 | Testimonial Block | 90 | 7 | 11 | 500 | file system operations mkdir | ||
| #1860 | Infobox | 91 | 8 | 10 | 1k+ | file system operations mkdir | ||
| #1861 | WPSSO Tune WP Image Editors | 91 | 35 | 10 | 800 | Missing Translators Comment | ||
| #1862 | MWW Scheduled Post Trigger | 92 | 4 | 2 | 60k+ | Direct Query | ||
| #1863 | MediaMan – Where is this Image Used? | 92 | 2 | 12 | 500 | Direct Query |
