PluginScore

WordPress.DB.PreparedSQLPlaceholders.LikeWildcardsInQuery

Like Wildcards In Query

A SQL query is built in a way that Plugin Check cannot verify as safely prepared.

critical weight

Why It Shows Up

The scan found missing, incorrect, quoted, unsupported, or mismatched SQL placeholders around `$wpdb->prepare()` usage.

Why It Matters

Broken preparation can leave dynamic SQL values unsafe or make queries behave differently than intended.

How to Fix

  • Keep placeholders in the SQL string and pass dynamic values as separate arguments.
  • Use the placeholder that matches the value type.
  • Do not quote placeholders manually, and use allowlists for identifiers or SQL fragments.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#1RestroPress – Online Food Ordering System175243,1551k+Non-prefixed global variable
#2MBE eShip205277401k+Non-prefixed global variable
#3Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots211,6212,03310k+Direct Query
#4SMS Extension for Contact Form 7217201,387400Non-prefixed global variable
#5MotoPress Hotel Booking213,0671,03710k+Text Domain Mismatch
#6Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred211,4783,33710k+Non-prefixed global variable
#7User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor217031,46340k+Missing Translators Comment
#8PublishPress Planner – Editorial Calendar, Marketing Content, Kanban Board216038906k+Output is not escaped
#9Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin211,0642,97540k+Direct Query
#10Events Maker by dFactory225888191k+Output is not escaped
#11Falang multilanguage for WordPress227167691k+Output is not escaped
#12Finale Lite – Sales Countdown Timer & Discount for WooCommerce221,0314514k+Output is not escaped
#13GeoDirectory – WP Business Directory Plugin and Classified Listings Directory224,4653,97610k+Output is not escaped
#14Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms221,03172220k+Unsafe printing function
#15LearnPress – WordPress LMS Plugin for Create and Sell Online Courses222,4333,59470k+Non-prefixed global variable
#16Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization221,3062,8188k+Output is not escaped
#17Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress229191,23010k+Output is not escaped
#18Product Catalog Feed by PixelYourSite225813578k+Output is not escaped
#19Welcart e-Commerce2210,37610,93610k+Text Domain Mismatch
#20CLUEVO LMS, E-Learning Platform231,8431,176400Text Domain Mismatch
#21Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe239,35826,4301k+Non-prefixed global variable
#22DK PDF – WordPress PDF Generator237443353k+Exception output is not escaped
#23Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light23386999400Non-prefixed global variable
#24FV Flowplayer Video Player231,3111,45420k+Output is not escaped
#25IP Geo Block233995898k+Output is not escaped
#26King Addons for Elementor – 80+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce, Mega Menu, Popup Builder231,8323,87710k+Non-prefixed global variable
#27Restaurant Menu and Food Ordering233858532k+Non-prefixed global variable
#28Photo Gallery by 10Web – Mobile-Friendly Image Gallery234,1591,553100k+Output is not escaped
#29Request a Quote – Quote Forms for Any WordPress Site232401,099900Non-prefixed hook name
#30UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP236952,44020k+Non-prefixed hook name
#31Web Directory Free232,5391,200400Text Domain Mismatch
#32Lead Form Data Collection to CRM232111,698400Non-prefixed global variable
#33FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce237982,19220k+SQL query is not prepared
#34Customer Support Ticket System & Helpdesk231,7231,454400Text Domain Mismatch
#35WP Webhooks – Automate repetitive tasks by creating powerful automation workflows directly within WordPress234,38088820k+Output is not escaped
#36Yatra – Travel Booking & Tour Operator Software232,2424,047600Non-prefixed global variable
#37Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress232,3171,7145k+Output is not escaped
#38Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More2435262340k+Non-prefixed global variable
#39Custom Twitter Feeds – A Tweets Widget or X Feed Widget24436932100k+Output is not escaped
#40Etsy Integration For WooCommerce241,2464,643900Non-prefixed global variable
#41F12 Profiler24282451500Direct Query
#42Featured Image from URL (FIFU)241,65441870k+Non Singular String Literal Domain
#43Fix Alt Text245443461k+Non Singular String Literal Domain
#44FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution2420379780k+Direct Query
#45Food Store – Online Food Delivery & Pickup248621,9411k+Non-prefixed global variable
#46Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder244,7451,27930k+Non Singular String Literal Domain
#47FV Player 8243231,3831k+Non-prefixed function
#48ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin)24158435300k+Nonce verification recommended
#49MailerPress – Email Marketing, Newsletter, Email Automation & WooCommerce Emails248053,9341k+Direct Query
#50PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes2442260110k+Missing Translators Comment