PluginScore

WordPress.DB.PreparedSQLPlaceholders.LikeWildcardsInQuery

Like Wildcards In Query

A SQL query is built in a way that Plugin Check cannot verify as safely prepared.

critical weight

Why It Shows Up

The scan found missing, incorrect, quoted, unsupported, or mismatched SQL placeholders around `$wpdb->prepare()` usage.

Why It Matters

Broken preparation can leave dynamic SQL values unsafe or make queries behave differently than intended.

How to Fix

  • Keep placeholders in the SQL string and pass dynamic values as separate arguments.
  • Use the placeholder that matches the value type.
  • Do not quote placeholders manually, and use allowlists for identifiers or SQL fragments.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#1RestroPress – Online Food Ordering System175353,2111k+Non-prefixed global variable
#2Administrator Z182,061799400Output is not escaped
#3MBE eShip205277401k+Non-prefixed global variable
#4Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots211,6522,05810k+Direct Query
#5Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred211,4363,34510k+Non-prefixed global variable
#6User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor217391,49540k+Non-prefixed global variable
#7PublishPress Planner – Editorial Calendar, Marketing Content, Kanban Board216038906k+Output is not escaped
#8Events Maker by dFactory225888191k+Output is not escaped
#9Falang multilanguage for WordPress227167701k+Output is not escaped
#10GeoDirectory – WP Business Directory Plugin and Classified Listings Directory224,4523,94510k+Output is not escaped
#11Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms221,03172220k+Unsafe printing function
#12King Addons for Elementor – 80+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce, Mega Menu, Popup Builder221,8353,89910k+Non-prefixed global variable
#13LearnPress – WordPress LMS Plugin for Create and Sell Online Courses222,3713,61770k+Non-prefixed global variable
#14Search Atlas SEO – OTTO AI SEO Automation for WordPress221,4032,8788k+Output is not escaped
#15MotoPress Hotel Booking223,0671,05010k+Text Domain Mismatch
#16Product Catalog Feed by PixelYourSite225813577k+Output is not escaped
#17Welcart e-Commerce2210,35010,87510k+Text Domain Mismatch
#18CLUEVO LMS, E-Learning Platform231,8431,176400Text Domain Mismatch
#19RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress239073,808400Request data is not unslashed
#20Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe239,58427,7311k+Non-prefixed global variable
#21DK PDF – WordPress PDF Generator237443353k+Exception output is not escaped
#22Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light23386999400Non-prefixed global variable
#23Finale Lite – Sales Countdown Timer & Discount for WooCommerce231,0223813k+Output is not escaped
#24Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder234,7401,27930k+Non Singular String Literal Domain
#25FV Flowplayer Video Player231,2801,45610k+Output is not escaped
#26IP Geo Block233995898k+Output is not escaped
#27Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress239311,24710k+Output is not escaped
#28Restaurant Menu and Food Ordering233858292k+Non-prefixed global variable
#29MxChat – AI Chatbot & Content Generation for WordPress233,6591,8002k+Text Domain Mismatch
#30Photo Gallery by 10Web – Mobile-Friendly Image Gallery234,1561,553100k+Output is not escaped
#31Request a Quote – Quote Forms for Any WordPress Site232401,099900Non-prefixed hook name
#32UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP236992,44120k+Non-prefixed hook name
#33Web Directory Free232,6201,105400Text Domain Mismatch
#34Lead Form Data Collection to CRM232111,698400Non-prefixed global variable
#35FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce237982,19320k+SQL query is not prepared
#36Customer Support Ticket System & Helpdesk231,7231,454400Text Domain Mismatch
#37WP Webhooks – Automate repetitive tasks by creating powerful automation workflows directly within WordPress234,38088820k+Output is not escaped
#38Yatra – Travel Booking & Tour Operator Software232,2674,090600Non-prefixed global variable
#39Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress232,3171,7145k+Output is not escaped
#40Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment243841,7551k+Non-prefixed global variable
#41Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More2440769640k+Non-prefixed global variable
#42SMS Extension for Contact Form 7246331,381400Non-prefixed global variable
#43Custom Twitter Feeds – A Tweets Widget or X Feed Widget24449932100k+Output is not escaped
#44Etsy Integration For WooCommerce241,2464,643900Non-prefixed global variable
#45F12 Profiler24282451400Direct Query
#46Fix Alt Text245443461k+Non Singular String Literal Domain
#47FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution2420580380k+Direct Query
#48Food Store – Online Food Delivery & Pickup248241,9171k+Non-prefixed global variable
#49FunnelKit – Funnel Builder for WooCommerce Checkout241,0582,31630k+Non-prefixed global variable
#50FV Player 8243301,3721k+Non-prefixed function