PluginScore

WordPress.DB.PreparedSQL.NotPrepared

SQL query is not prepared

A database query includes dynamic data without using `$wpdb->prepare()` or an equivalent safe pattern.

critical weight

Why It Shows Up

The scan found a SQL string passed to `$wpdb` where variables appear to be interpolated or concatenated directly.

Why It Matters

Unprepared SQL can allow SQL injection when user-controlled values reach the query.

How to Fix

  • Move dynamic values into placeholders such as `%s`, `%d`, `%f`, or `%i` where supported.
  • Pass the values as separate arguments to `$wpdb->prepare()`.
  • For table names, column names, and sort directions, use strict allowlists instead of raw user input.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#151Modula Image Gallery – Photo Grid & Video Gallery22474436100k+Text Domain Mismatch
#152Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress229191,23010k+Output is not escaped
#153myCred Addons – Ultimate myCred Modules To Support WordPress Gamification and Loyalty Rewards222,3441,320400Output is not escaped
#154Newsletters222,9682,2482k+Text Domain Mismatch
#155WP OAuth Server (OAuth Authentication)221893473k+Non-prefixed function
#156PagBank / PagSeguro Connect para WooCommerce225047574k+Non-prefixed global variable
#157PAYCOMET for WooCommerce221,2064232k+Text Domain Mismatch
#158PDF Builder for WPForms22321266900SQL query is not prepared
#159Smart Popup by Supsystic223,17250310k+Non Singular String Literal Domain
#160Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App221,5812,326300k+Non-prefixed global variable
#161Prime Mover – Migrate WordPress Website & Backups221,3261,60010k+Non-prefixed global variable
#162Product Catalog Feed by PixelYourSite225813578k+Output is not escaped
#163Pronamic Pay222581,0772k+Non-prefixed global variable
#164PageSpeed Ninja – Cache, Minify, Defer CSS JavaScript, Critical CSS, Optimize Images, Convert WebP229844075k+Unsafe printing function
#165RealPress – Real Estate Plugin226041,167500Non-prefixed global variable
#166Restrict User Access – Ultimate Membership & Content Protection229771,84010k+Non-prefixed global variable
#167Sellsy22586490400Non Singular String Literal Domain
#168Seraphinite Accelerator2259425550k+Output is not escaped
#169ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF221,044800300k+Non-prefixed global variable
#170Simple Job Board226341,35510k+Non-prefixed global variable
#171Slim Jetpack222,5861,9472k+Text Domain Mismatch
#172NextScripts: Social Networks Auto-Poster222,4081,13330k+Output is not escaped
#173SportsPress – Sports Club & League Manager224602,24610k+Non-prefixed global variable
#174Stylish Price List – Price Table Builder & QR Code Restaurant Menu226746783k+Output is not escaped
#175Swift Performance Lite222,3461,3257k+Text Domain Mismatch
#176Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent222255198k+error log error log
#177Ultimeter227511,3441k+Non-prefixed global variable
#178Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin225322,36740k+Direct Query
#179Unlimited Elements Blocks Library227081,822400Non-prefixed global variable
#180Search & Replace Everything – Quick and Easy Way to Find and Replace Text, Links221,0441,79720k+Non-prefixed global variable
#181URL Shortify – Simple and Easy URL Shortener221,5202,68910k+Non-prefixed global variable
#182Welcart e-Commerce2210,37810,93110k+Text Domain Mismatch
#183UserFeedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds22444243200k+Text Domain Mismatch
#184WCFM – Frontend Manager for WooCommerce224,7545,05420k+Non-prefixed global variable
#185WCFM Marketplace – Multivendor Marketplace for WooCommerce221,9341,96610k+Non-prefixed global variable
#186WCFM Membership – WooCommerce Memberships for Multivendor Marketplace2255967510k+Non-prefixed global variable
#187WooCommerce221,3596,1727m+Non-prefixed global variable
#188Advanced AJAX Product Filters222,6831,20550k+Text Domain Mismatch
#189CoDesigner – All in One Elementor WooCommerce Builder224,1317745k+Text Domain Mismatch
#190ManageWP Worker225075651m+Non-prefixed class
#191Asset CleanUp: Page Speed Booster222,0302,485100k+Non-prefixed global variable
#192WP Express Checkout (Fast Payments via PayPal & Stripe)225916271k+Output is not escaped
#193File Manager227405201m+Unsafe printing function
#194WP Fusion Lite – Marketing Automation and CRM Integration for WordPress222756835k+Nonce verification recommended
#195WP Umbrella: Update Backup Restore & Monitoring2292191970k+Exception output is not escaped
#196SchedulePress – Auto Post & Publish, Auto Social Share, Schedule Posts with Editorial Calendar & Missed Schedule Post Publisher2230724510k+Output is not escaped
#197User Frontend: AI Powered Frontend Posting, User Directory, Profile Builder, Membership & User Registration222871,43220k+Non-prefixed global variable
#198WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell226,0022,7905k+Text Domain Mismatch
#199ShopWP22430225700Text Domain Mismatch
#200WPSSO Core – Complete Schema Markup and Meta Tags221,4074125k+Missing Translators Comment