PluginScore

WordPress.DB.PreparedSQLPlaceholders.LikeWildcardsInQuery

Like Wildcards In Query

A SQL query is built in a way that Plugin Check cannot verify as safely prepared.

critical weight

Why It Shows Up

The scan found missing, incorrect, quoted, unsupported, or mismatched SQL placeholders around `$wpdb->prepare()` usage.

Why It Matters

Broken preparation can leave dynamic SQL values unsafe or make queries behave differently than intended.

How to Fix

  • Keep placeholders in the SQL string and pass dynamic values as separate arguments.
  • Use the placeholder that matches the value type.
  • Do not quote placeholders manually, and use allowlists for identifiers or SQL fragments.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#51RSFirewall!245635214k+Output is not escaped
#52SecuPress with Simple SSL – Simple and Performant Security241,6951,60040k+Non-prefixed global variable
#53Spotlight Social Feeds – Block, Shortcode, and Widget2441114760k+Output is not escaped
#54Squad Modules Lite – Free Divi 5 & Divi 4 Modules for Divi Builder246051,4721k+Non-prefixed global variable
#55Ultimate WP Mail24400546700Unsafe printing function
#56WPML Multilingual & Multicurrency for WooCommerce241,5991,691100k+SQL query is not prepared
#57Auto Affiliate Links243814163k+Output is not escaped
#58WSMS (formerly WP SMS) – SMS & MMS Notifications with OTP and 2FA for WooCommerce24931,7327k+Non-prefixed hook name
#59WP-Stateless – Google Cloud Storage241,0364824k+Non Singular String Literal Domain
#60All 404 Redirect to Homepage25140301200k+date date
#61ATUM WooCommerce Inventory Management and Stock Tracking252,6111,29610k+Non Singular String Literal Domain
#62Booking Calendar Contact Form25371884500Input is not validated
#63Bulk Edit Categories and Tags – Create Thousands Quickly on the Editor251,0411,0164k+Text Domain Mismatch
#64Bulk Edit and Create User Profiles – WP Sheet Editor259951,0011k+Text Domain Mismatch
#65Contact Form Email254098989k+Non-prefixed global variable
#66CP Contact Form with PayPal25466936800Unsafe printing function
#67FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler253255267k+Non-prefixed global variable
#68Form Vibes – Save Contact Form 7 & Elementor Form Entries to Database257161,50910k+Non-prefixed global variable
#69FunnelKit – Funnel Builder for WooCommerce Checkout253,1642,62430k+Text Domain Mismatch
#70MonsterInsights – Google Analytics Dashboard for WordPress (Website Stats Made Easy)251574352m+Nonce verification recommended
#71IP Location Block2552162410k+Output is not escaped
#72Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force Prevention256176141m+Unsafe printing function
#73Bulk Page Generator – LPagery256651,9223k+Non-prefixed global variable
#74Media Cleaner: Clean your WordPress!2526155490k+Direct Query
#75MxChat – AI Chatbot & Content Generation for WordPress253,4481,4862k+Text Domain Mismatch
#76Open User Map – Interactive Leaflet Maps258991,00010k+Non-prefixed global variable
#77phpinfo() WP – Site Health, PHP Compatibility & Server Audit259097223k+Non-prefixed global variable
#78SEO Repair Kit – Meta Manager, Schema Manager, SEO Content Monitoring, GSC Integration, Keyword & Rank Tracking251969022k+Direct Query
#79Smart Image Resize for WooCommerce255824047k+Text Domain Mismatch
#80Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management2536792410k+SQL query is not prepared
#81STAGGS – Product Configurator Toolkit256262,180400Non-prefixed global variable
#82Bulk Edit Products for WooCommerce – WP Sheet Editor2595796810k+Text Domain Mismatch
#83Bulk Edit Coupons for WooCommerce – WP Sheet Editor251,022982500Text Domain Mismatch
#84Pay with Vipps and MobilePay for WooCommerce258525165k+Output is not escaped
#85Iptanus File Upload255171,33710k+Non-prefixed function
#86WP Google Review Slider251,3682,59630k+Non-prefixed global variable
#87Perfect Images: Regenerate Thumbnails, Image Sizes, WebP & AVIF2515811860k+Non-prefixed global variable
#88Bulk Edit Posts and Products in Spreadsheet259349448k+Text Domain Mismatch
#89WP Time Slots Booking Form254391,1371k+Non-prefixed global variable
#90Video Gallery – YouTube Gallery, Playlist & Video Grid252751,0662k+Non-prefixed hook name
#91WP Frontend Admin – Display WP Admin Pages in the Frontend26347337400Non Singular String Literal Domain
#92Paytium: Mollie payment forms & donations265065513k+Unsafe printing function
#93SP Move Login268812156k+Text Domain Mismatch
#94Polls CP27399500400Output is not escaped
#95Gallery – Photo Albums Plugin276472522k+Output is not escaped
#96Ultimate Watermark – Image Watermark, Image Protection & Bulk Watermarking271643031k+Nonce verification recommended
#97Database Cleaner2813929410k+Direct Query
#98Jetpack VaultPress287136210k+Missing nonce verification
#99Music Player for WooCommerce291071561k+Non-prefixed global variable
#100WPComplete293833331k+Output is not escaped