PluginScore

WordPress.DB.PreparedSQL.NotPrepared

SQL query is not prepared

A database query includes dynamic data without using `$wpdb->prepare()` or an equivalent safe pattern.

critical weight

Why It Shows Up

The scan found a SQL string passed to `$wpdb` where variables appear to be interpolated or concatenated directly.

Why It Matters

Unprepared SQL can allow SQL injection when user-controlled values reach the query.

How to Fix

  • Move dynamic values into placeholders such as `%s`, `%d`, `%f`, or `%i` where supported.
  • Pass the values as separate arguments to `$wpdb->prepare()`.
  • For table names, column names, and sort directions, use strict allowlists instead of raw user input.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#351WP Ultimate CSV Importer – WordPress Import & Export for CSV, XML & Excel231,1193,51620k+Interpolated SQL is not prepared
#352WP Webhooks – Automate repetitive tasks by creating powerful automation workflows directly within WordPress234,37689020k+Output is not escaped
#353WPMobile.App232,9831,5273k+Output is not escaped
#354WPCal.io – Easy Meeting Scheduler23694595900Direct Query
#355Comments – wpDiscuz236201,18070k+Non-prefixed global variable
#356Photo Engine (Media Organizer & Lightroom)232526502k+Direct Query
#357Yatra – Travel Booking & Tour Operator Software232,2113,994600Non-prefixed global variable
#358YITH WooCommerce Ajax Product Filter234631,52780k+Non-prefixed global variable
#359Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress232,3171,7145k+Output is not escaped
#360Zephyr Project Manager236672,4541k+Non-prefixed global variable
#361404 Solution244861,33810k+Non-prefixed class
#362A2 Optimized WP – Turbocharge and secure your WordPress site2427123160k+Missing Arg Domain
#363Academy LMS – WordPress LMS Plugin for Complete eLearning Solution241627872k+Non-prefixed global variable
#364Anti Spam and list cleaner – AcyChecker2446288400Output is not escaped
#365AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress245,2301,4647k+Output is not escaped
#366Ad Inserter – Ad Manager & AdSense Ads244,241811300k+Output is not escaped
#367Ivory Search – WordPress Search Plugin241,1731,688100k+Non-prefixed global variable
#368Affiliates Manager241,2686539k+Unsafe printing function
#369All-In-One Security (AIOS) – Security and Firewall245521,2281m+Non-prefixed global variable
#370Starter Templates – AI-Powered Templates for Elementor & Gutenberg241253941m+Non-prefixed hook name
#371TermsFeed AutoTerms: Privacy Policy Generator, Cookie Consent, GDPR, CCPA, Terms & Conditions, Disclaimers, Cookies Policy, EULA2493916170k+Non Singular String Literal Domain
#372AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress241,7051,3937k+Text Domain Mismatch
#373Popup Box – Create Countdown, Coupon, Video, Contact Form Popups244821,25350k+Non-prefixed global variable
#374Backuply – Backup, Restore, Migrate and Clone24704551700k+Non-prefixed global variable
#375Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale)241,8371,0631k+Text Domain Mismatch
#376Product Feed Manager For WooCommerce – Sell on 200+ Online Marketplaces242,2483,33810k+slow db query meta key
#377Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More243429306k+Non-prefixed global variable
#378Arigato Autoresponder and Newsletter241,318769500Text Domain Mismatch
#379BlockMeister – Block Pattern Builder245801,4051k+Non-prefixed global variable
#380Bookit — Booking & Appointment Calendar245661,4564k+Non-prefixed global variable
#381Branda – White Label & Branding, Free Login Page Customizer243,17482020k+Text Domain Mismatch
#382BrikPanel — WooCommerce Dashboard, Sales Report, Google Sheets Sync, Inventory Management & Bulk Editor243,9501,265400Text Domain Mismatch
#383Bulk Edit Categories and Tags – Create Thousands Quickly on the Editor241,0259844k+Text Domain Mismatch
#384Bulk Edit and Create User Profiles – WP Sheet Editor249799691k+Text Domain Mismatch
#385WOLF – WordPress Posts Bulk Editor and Manager Professional244856234k+Output is not escaped
#386Calculated Fields Form2428359940k+Non-prefixed global variable
#387Event Calendar – Calendar241,1111,2622k+Text Domain Mismatch
#388Categorify – WordPress Media Library Category & File Manager245731,3851k+Non-prefixed global variable
#389Message Filter for Contact Form 7241,0571,5941k+Non-prefixed global variable
#390Kognetiks Chatbot for WordPress246511,486600Non-prefixed global variable
#391CleanTalk Anti-Spam. Spam Firewall & Bot protection248251,079200k+Missing nonce verification
#392Smart Online Order for Clover241,7461,2461k+Text Domain Mismatch
#393CM Pop-Up – Create engaging popups to capture attention and boost interaction244664088k+Output is not escaped
#394Complianz – GDPR/CCPA Cookie Consent244874031m+Missing Arg Domain
#395RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress248283,665500Request data is not unslashed
#396CF7 Apps – Honeypot, Database, Redirection, Webhook, and Addons for Contact Form 7241,0341,396300k+Non-prefixed global variable
#397Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress245293571k+Text Domain Mismatch
#398WPBot – ChatBot Conversational Forms241,2541,2262k+Text Domain Mismatch
#399CRM Perks Forms – WordPress Form Builder248195771k+Output is not escaped
#400Custom CSS247036571k+Output is not escaped