PluginScore

WordPress.DB.PreparedSQL.NotPrepared

SQL query is not prepared

A database query includes dynamic data without using `$wpdb->prepare()` or an equivalent safe pattern.

critical weight

Why It Shows Up

The scan found a SQL string passed to `$wpdb` where variables appear to be interpolated or concatenated directly.

Why It Matters

Unprepared SQL can allow SQL injection when user-controlled values reach the query.

How to Fix

  • Move dynamic values into placeholders such as `%s`, `%d`, `%f`, or `%i` where supported.
  • Pass the values as separate arguments to `$wpdb->prepare()`.
  • For table names, column names, and sort directions, use strict allowlists instead of raw user input.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#201ЮKassa для WooCommerce225901689k+Short PHP open tag found
#202Recipe Cards For Your Food Blog from Zip Recipes221,1261,7311k+Non-prefixed global variable
#203Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce231,1851,0271k+Text Domain Mismatch
#204Advanced Custom Fields: Extended231,885329100k+Text Domain Mismatch
#205Frontend Admin by DynamiApps235,9383,2089k+Text Domain Mismatch
#206Admin and Site Enhancements (ASE)23137330200k+Nonce verification recommended
#207Advanced Ads – Ad Manager & AdSense23559719100k+Non-prefixed global variable
#208Advanced Form Integration — Connect Forms to 200+ Apps235,7834,68710k+wp function not compatible with requires wp
#209AI Engine – The Chatbot, AI Framework & MCP for WordPress23408539100k+error log error log
#210AR for WordPress23151499400Non-prefixed global variable
#211Shortcodes and extra features for Phlox theme2341242490k+Output is not escaped
#212B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More231,34740910k+Text Domain Mismatch
#213BA Book Everything231,1841,08610k+Output is not escaped
#214Kadence Security – Password, Two Factor Authentication, and Brute Force Protection231,053967700k+Missing Translators Comment
#215Booking calendar, Appointment Booking System231,0791,1253k+Output is not escaped
#216BSK PDF Manager231,5766257k+Text Domain Mismatch
#217BuddyDrive237221,5971k+Non-prefixed global variable
#218BuddyPress235849,012100k+Non-prefixed function
#219Announcement & Notification Banner – Bulletin239301,5762k+Non-prefixed global variable
#220Business Directory Plugin – Easy Listing Directories for WordPress236111,06310k+Non-prefixed global variable
#221Geo Controller23914501k+Non-prefixed global variable
#222WPBot – AI ChatBot for Live Support, Lead Generation, AI Services234881,1625k+Non-prefixed global variable
#223Classified Listing – AI-Powered Classified ads & Business Directory231552,0749k+Non-prefixed global variable
#224CLUEVO LMS, E-Learning Platform231,8431,176400Text Domain Mismatch
#225Content Aware Sidebars – Fastest Widget Area Plugin239931,73830k+Non-prefixed global variable
#226Content Egg – Affiliate Product Importer & Price Comparison231,2451,27510k+Non-prefixed global variable
#227Content Views – Post Grid & Filter, Recent Posts, Category Posts … (Shortcode, Gutenberg Blocks, and Widgets for Elementor)23306587100k+Dynamic hook name
#228Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe239,31526,6441k+Non-prefixed global variable
#229Free Theme Builder for Elementor – CRT Addons (Header, Footer, Archive, WooCommerce & 50+ Widgets)237912,331400Non-prefixed global variable
#230Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy2317082140k+Non-prefixed global variable
#231Easy Digital Downloads – eCommerce Payments and Subscriptions made easy233,72310,28340k+Non-prefixed namespace
#232ElementsReady Addons for Elementor232316663k+Non-prefixed global variable
#233EventON – Events Calendar232,5851,0216k+Text Domain Mismatch
#234Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI233951,34290k+Non-prefixed global variable
#235Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light23386999400Non-prefixed global variable
#236Ezoic2343251610k+Output is not escaped
#237Image Photo Gallery Final Tiles Grid235781,50220k+Non-prefixed global variable
#238Flexmls® IDX Plugin231,2689571k+Output is not escaped
#239Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder234,7461,27930k+Non Singular String Literal Domain
#240Freshdesk (official)23194386800Non-prefixed function
#241Front End PM239782,2645k+Non-prefixed global variable
#242Tracking and Consent Manager – WP Full Picture231,2803,2233k+Non-prefixed global variable
#243FV Flowplayer Video Player231,3111,45420k+Output is not escaped
#244GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress233,5892,76010k+Output is not escaped
#245Anti-Malware Security and Brute-Force Firewall23543965100k+Output is not escaped
#246Gmedia Photo Gallery233501,1217k+Non-prefixed global variable
#247Groovy Menu Plugin (Free)231,7292834k+Text Domain Mismatch
#248Groundhogg — CRM, Newsletters, and Marketing Automation231369212k+Non-prefixed global variable
#249Interactive Content – H5P2356538040k+Non Singular String Literal Domain
#250Happy Addons for Elementor23573444400k+Output is not escaped