PluginScore

WordPress.DB.PreparedSQL.NotPrepared

SQL query is not prepared

A database query includes dynamic data without using `$wpdb->prepare()` or an equivalent safe pattern.

critical weight

Why It Shows Up

The scan found a SQL string passed to `$wpdb` where variables appear to be interpolated or concatenated directly.

Why It Matters

Unprepared SQL can allow SQL injection when user-controlled values reach the query.

How to Fix

  • Move dynamic values into placeholders such as `%s`, `%d`, `%f`, or `%i` where supported.
  • Pass the values as separate arguments to `$wpdb->prepare()`.
  • For table names, column names, and sort directions, use strict allowlists instead of raw user input.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#251Interactive Content – H5P2356538040k+Non Singular String Literal Domain
#252Happy Addons for Elementor23573444400k+Output is not escaped
#253Houzez Property Feed231,4641,5851k+Text Domain Mismatch
#254Hunk Companion232,5476876k+Text Domain Mismatch
#255Ibtana – Ecommerce Product Addons231,5471,7186k+Non Singular String Literal Domain
#256Payment forms, Buy now buttons, and Invoicing System | GetPaid233891,2665k+Non-prefixed global variable
#257IP Geo Block233995898k+Output is not escaped
#258Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress2391693300k+Non-prefixed namespace
#259Joli FAQ SEO – WordPress FAQ Plugin231,0831,526700Non-prefixed global variable
#260Justified Gallery235891,4178k+Non-prefixed global variable
#261King Addons for Elementor – 80+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce, Mega Menu, Popup Builder231,8343,87710k+Non-prefixed global variable
#262Masteriyo LMS – LMS Course Builder, Quizzes & Certificates231902,1225k+Non-prefixed global variable
#263License Manager for WooCommerce231297976k+Nonce verification recommended
#264Like Button Rating ♥ LikeBtn231,2316174k+Unsafe printing function
#265Link Whisper Free233,8825,30330k+Text Domain Mismatch
#266LLMagnet – AI Visibility & AI SEO for Claude, ChatGPT & More236271,798300Non-prefixed global variable
#267Locatoraid Store Locator233186451k+Non-prefixed global variable
#268Login With Ajax – Fast Logins, 2FA, Redirects2362352010k+Output is not escaped
#269Master Slider – Responsive Touch Slider2380040860k+Output is not escaped
#270MasterStudy LMS WordPress Plugin – for Online Courses and Education231,4194,87510k+Non-prefixed global variable
#271Media Library Assistant231,1443,94370k+Nonce verification recommended
#272MediaPress239045834k+Output is not escaped
#273Moloni239013562k+Missing Arg Domain
#274MotoPress Appointment Booking232,3628572k+Text Domain Mismatch
#275Restaurant Menu and Food Ordering233858532k+Non-prefixed global variable
#276MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar234,06548820k+Text Domain Mismatch
#277MStore API – Create Native Android & iOS Apps On The Cloud236187643k+SQL query is not prepared
#278MultiParcels Shipping For WooCommerce231963624k+Mixed line endings
#279MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO234855802k+Missing nonce verification
#280Next Active Directory Integration236832842k+Exception output is not escaped
#281Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery232,129993400k+Text Domain Mismatch
#282Nirweb support23254617800Request data is not unslashed
#283NitroPack – Performance, Page Speed & Cache Plugin for Core Web Vitals, CDN & Image Optimization23316639100k+Output is not escaped
#284Issues and Series for Newspapers, Magazines, Publishers, Writers233467102k+Nonce verification recommended
#285Patchstack – WordPress & Plugins Security2310748950k+Missing nonce verification
#286PayPal Brasil para WooCommerce235543281k+Unsafe printing function
#287Photo Gallery by 10Web – Mobile-Friendly Image Gallery234,1591,553100k+Output is not escaped
#288ExpressTechSoftwares Discord Add-on for Paid Memberships Pro23454449700Text Domain Mismatch
#289AI Popup231,224636400Text Domain Mismatch
#290Post to Google My Business (Google Business Profile)238451,45210k+Non-prefixed global variable
#291Postie2340825910k+Output is not escaped
#292PowerPress Podcasting plugin by Blubrry234,8072,39420k+Output is not escaped
#293Print Anywhere & Create PDFs of Order Receipts, Invoices, Labels & More.231,4854441k+Text Domain Mismatch
#294Product Watermark for WooCommerce236964572k+Output is not escaped
#295Radio Station by netmix® – Manage and play your Show Schedule in WordPress!239343,6191k+Non-prefixed global variable
#296Read More Without Refresh239551,34720k+Non-prefixed global variable
#297Redirection23523457100k+Non-prefixed global variable
#298Request a Quote – Quote Forms for Any WordPress Site232401,0991k+Non-prefixed hook name
#299Robo Gallery – Photo & Image Slider231,29153040k+Output is not escaped
#300Schema231,17324540k+Text Domain Mismatch