PluginScore

WordPress.DB.PreparedSQL.NotPrepared

SQL query is not prepared

A database query includes dynamic data without using `$wpdb->prepare()` or an equivalent safe pattern.

critical weight

Why It Shows Up

The scan found a SQL string passed to `$wpdb` where variables appear to be interpolated or concatenated directly.

Why It Matters

Unprepared SQL can allow SQL injection when user-controlled values reach the query.

How to Fix

  • Move dynamic values into placeholders such as `%s`, `%d`, `%f`, or `%i` where supported.
  • Pass the values as separate arguments to `$wpdb->prepare()`.
  • For table names, column names, and sort directions, use strict allowlists instead of raw user input.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#401Custom Twitter Feeds – A Tweets Widget or X Feed Widget24446922100k+Output is not escaped
#402Customer Reviews for WooCommerce242,2062,44380k+Output is not escaped
#403Defender Security – Malware Scanner, Login Security & Firewall2430651880k+Non-prefixed namespace
#404WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes)248452,6654k+Non-prefixed global variable
#405Democracy Poll243874367k+Short PHP open tag found
#406Digital License Manager24295670700Non-prefixed hook name
#407Doubly – Cross Domain Copy Paste for WordPress242525510k+Output is not escaped
#408DSGVO All in one for WP24751,63720k+Non-prefixed global variable
#409Dynamic Widgets2463181210k+Non-prefixed global variable
#410Easy Form Builder by WhiteStudio — Drag & Drop Form Builder241943831k+Nonce verification recommended
#411Easy Invoice – Invoice Generator, PDF Quotes & Payments241,3662,006500Non-prefixed global variable
#412Easy Modal245642997k+Unsafe printing function
#413E-cab Taxi Booking Manager for Woocommerce243561,4622k+Non-prefixed global variable
#414eCommerce Product Catalog Plugin for WordPress246213,1777k+Non-prefixed function
#415ECPay Ecommerce for WooCommerce244917392k+Missing nonce verification
#416Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress246521,49560k+Non-prefixed hook name
#417EmbedPress – PDF Embedder, Embed PDF viewer, YouTube Videos, 3D FlipBook, Social feeds & more246691,550100k+Output is not escaped
#418Enable Media Replace24212276600k+Output is not escaped
#419Conversios: Google Analytics (GA4), Google Ads, Conversion and Analytics Tracking for Multi-Channels241071,46110k+Non-prefixed global variable
#420Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns24120684200k+Non-prefixed global variable
#421Event Tickets and Registration243,4114,21790k+Non-prefixed global variable
#422Etsy Integration For WooCommerce241,2464,643900Non-prefixed global variable
#423F12 Profiler24282451500Direct Query
#424Fast Velocity Minify2428225640k+Unsafe printing function
#425Fattura2424312333400Output is not escaped
#426Featured Image from URL (FIFU)241,65441870k+Non Singular String Literal Domain
#427Featured Post with thumbnail24158122400Output is not escaped
#428FeedWordPress244963199k+Missing Arg Domain
#429FileBird – WordPress Media Library Folders & File Manager24239377200k+wp function not compatible with requires wp
#430Fix Alt Text245443461k+Non Singular String Literal Domain
#431FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution2419375380k+Direct Query
#432Football Pool241,0857331k+Output is not escaped
#433Force Sell for WooCommerce24708452600Text Domain Mismatch
#434Formidable PRO2PDF242184771k+Non-prefixed global variable
#435Photo Gallery – Responsive Image Galleries by Supsystic242409120k+Text Domain Mismatch
#436Gallery by BestWebSoft – Customizable Image and Photo Galleries for WordPress2453632410k+Text Domain Mismatch
#437GD Mail Queue24502582700Output is not escaped
#438GG Woo Feed for WooCommerce Shopping Feed on Google and Other Channels244695921k+Non-prefixed global variable
#439Connector Wizard (formerly LC Wizard)242484641k+Non-prefixed function
#440Assets manager, dequeue scripts, dequeue styles for WordPress245922552k+Output is not escaped
#441Easy Google Maps241,76438920k+Non Singular String Literal Domain
#442GS Behance Portfolio – Display Projects, Gallery & Slider248551,617400Non-prefixed global variable
#443Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN243,41086670k+Text Domain Mismatch
#444Import and export users and customers241,04035770k+Unsafe printing function
#445Keap Official Opt-in Forms248291,0461k+Non-prefixed global variable
#446Social Slider Feed – Social Media Feed & Gallery Widgets2492970720k+Non-prefixed global variable
#447InstaWP Connect – 1-click WP Staging & Migration2425381140k+Non-prefixed global variable
#448Joli Table Of Contents246531,7557k+Non-prefixed global variable
#449LatePoint – Calendar Booking Plugin for Appointments and Events241,841937100k+Output is not escaped
#450LearnPress – Backup & Migration Tool243854695k+Output is not escaped