PluginScore

WordPress.DB.PreparedSQLPlaceholders.LikeWildcardsInQueryWithPlaceholder

Like Wildcards In Query With Placeholder

A SQL query is built in a way that Plugin Check cannot verify as safely prepared.

critical weight

Why It Shows Up

The scan found missing, incorrect, quoted, unsupported, or mismatched SQL placeholders around `$wpdb->prepare()` usage.

Why It Matters

Broken preparation can leave dynamic SQL values unsafe or make queries behave differently than intended.

How to Fix

  • Keep placeholders in the SQL string and pass dynamic values as separate arguments.
  • Use the placeholder that matches the value type.
  • Do not quote placeholders manually, and use allowlists for identifiers or SQL fragments.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#1Go Fetch Jobs (for WP Job Manager)191,4101,741700Non-prefixed global variable
#2SendPress Newsletters192,2931,4221k+Output is not escaped
#3Pix por Piggly (para Woocommerce)205471954k+Exception output is not escaped
#4WPScan – WordPress Security Scanner215272658k+Text Domain Mismatch
#5Knowledge Base documentation & wiki plugin – BasePress Docs226711,7672k+Non-prefixed global variable
#6DirectoryPress – Business Directory And Classified Ad Listing224,7872,795700Text Domain Mismatch
#7Business Directory Plugin – Easy Listing Directories for WordPress236111,06410k+Non-prefixed global variable
#8GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress233,5942,77510k+Output is not escaped
#9IP Geo Block233995898k+Output is not escaped
#10Restaurant Menu and Food Ordering233858532k+Non-prefixed global variable
#11Seriously Simple Podcasting2354862930k+Non-prefixed hook name
#12RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress248423,717500Request data is not unslashed
#13Media Library Folders2488980710k+Text Domain Mismatch
#14Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors2436982020k+Nonce verification recommended
#15Spotlight Social Feeds – Block, Shortcode, and Widget2441114760k+Output is not escaped
#16GEO Plugin by Squirrly SEO241,20223030k+Missing Translators Comment
#17Online Scheduling and Appointment Booking System – Bookly251,09590060k+SQL query is not prepared
#18Logo Slider – Logo Showcase, Logo Carousel, Logo Gallery and Client Logo Presentation2578931330k+Text Domain Mismatch
#19IP Location Block2552162410k+Output is not escaped
#20Pz-LinkCard259491,61420k+Non-prefixed global variable
#21MaxGalleria262785602k+Non-prefixed global variable
#22Advanced Shipping Rates for WooCommerce: Flexible Table Rate Shipping Rules281875052k+Non-prefixed global variable
#23ووکامرس فارسی28157215100k+Output is not escaped
#24AppPresser – Mobile App Framework292622141k+Text Domain Mismatch
#25WP Inventory Manager308692321k+Output is not escaped
#26Keywords to Links Converter31288144800Text Domain Mismatch
#27Cooked – Recipe Management324622753k+Output is not escaped
#28MapPress – Google Maps, OpenStreetMap & Leaflet3269612930k+Missing Arg Domain
#29Related Posts for WordPress3520718010k+Output is not escaped
#30REST API Log35791245k+Non-prefixed hook name
#31Decent Comments3893282k+Output is not escaped
#32Coding Chicken – JetEngine Importer385529400Missing direct file access protection
#33Zippy4043319k+Output is not escaped
#34Gelato Integration for WooCommerce4236325k+Output is not escaped
#35Search by SKU for Woocommerce69131010k+Direct Query
#36Vanilla PDF Embed85833k+parse url parse url