PluginScore

WordPress.DB.PreparedSQL.NotPrepared

SQL query is not prepared

A database query includes dynamic data without using `$wpdb->prepare()` or an equivalent safe pattern.

critical weight

Why It Shows Up

The scan found a SQL string passed to `$wpdb` where variables appear to be interpolated or concatenated directly.

Why It Matters

Unprepared SQL can allow SQL injection when user-controlled values reach the query.

How to Fix

  • Move dynamic values into placeholders such as `%s`, `%d`, `%f`, or `%i` where supported.
  • Pass the values as separate arguments to `$wpdb->prepare()`.
  • For table names, column names, and sort directions, use strict allowlists instead of raw user input.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#1851FileBird Document Library7623135k+Text Domain Mismatch
#1852FluentPlayer – Video Player With Forms & Lead Capture765401k+Database parameter is not escaped
#1853Category Order and Taxonomy Terms Order763510500k+wp function not compatible with requires wp
#1854UTM Event Tracker and Analytics, UTM Grabber76219900Interpolated SQL is not prepared
#1855Index WP Users For Speed7710351k+Non-prefixed global variable
#1856Posts List7711157k+Non-prefixed hook name
#1857Table Of Contents Block7715810k+wp function not compatible with requires wp
#1858Recent Posts7872400Database parameter is not escaped
#1859Flipbox8014172k+wp function not compatible with requires wp
#1860Media Library File Size803156k+Nonce verification recommended
#1861WP Social Ninja – Embed Social Feeds, User Reviews & Chat Widgets80261830k+Missing direct file access protection
#1862Countdown Block8114104k+wp function not compatible with requires wp
#1863Price Table Block811516900file system operations mkdir
#1864Progress Bars811514500file system operations mkdir
#1865Team Member Block8115141k+file system operations mkdir
#1866Toggle Content811612800file system operations mkdir
#1867Typing Text811516600file system operations mkdir
#1868Accordion Toggle8217112k+Non-prefixed class
#1869Image Gallery Block8213103k+wp function not compatible with requires wp
#1870Infobox8215121k+file system operations mkdir
#1871Parallax Slider Block8215121k+file system operations mkdir
#1872Image Slider Block8213143k+wp function not compatible with requires wp
#1873Testimonial Block821312500wp function not compatible with requires wp
#1874Events Calendar Modules for Divi841122k+Nonce verification recommended
#1875Floating Button – Easily Create Sticky, Fixed & Floating Buttons8461844k+Non-prefixed global variable
#1876Timeline Module for Divi8416113k+Text Domain Mismatch
#1877Auto Subpage Menu8556800Database parameter is not escaped
#1878GazChap's WooCommerce Auto Category Product Thumbnails85481k+trademarked term
#1879Vanilla PDF Embed85833k+parse url parse url
#1880WP Missed Schedule Posts877910k+trademarked term
#1881Disable Revisions90551k+Direct Query
#1882Featured Image Admin Thumb9071020k+Non-prefixed hook name
#1883HivePress Messages907107k+Direct Query
#1884WPSSO Tune WP Image Editors913510900Missing Translators Comment
#1885MWW Scheduled Post Trigger924260k+Direct Query
#1886MediaMan – Where is this Image Used?92212400Direct Query