PluginScore

WordPress.DB.PreparedSQLPlaceholders.LikeWildcardsInQueryWithPlaceholder

Like Wildcards In Query With Placeholder

A SQL query is built in a way that Plugin Check cannot verify as safely prepared.

critical weight

Why It Shows Up

The scan found missing, incorrect, quoted, unsupported, or mismatched SQL placeholders around `$wpdb->prepare()` usage.

Why It Matters

Broken preparation can leave dynamic SQL values unsafe or make queries behave differently than intended.

How to Fix

  • Keep placeholders in the SQL string and pass dynamic values as separate arguments.
  • Use the placeholder that matches the value type.
  • Do not quote placeholders manually, and use allowlists for identifiers or SQL fragments.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#1Go Fetch Jobs (for WP Job Manager)191,4101,741600Non-prefixed global variable
#2SendPress Newsletters192,2931,4221k+Output is not escaped
#3Pix por Piggly (para Woocommerce)205471954k+Exception output is not escaped
#4WPScan – WordPress Security Scanner215272658k+Text Domain Mismatch
#5DirectoryPress – Business Directory And Classified Ad Listing224,7872,795700Text Domain Mismatch
#6Knowledge Base documentation & wiki plugin – BasePress Docs236711,7672k+Non-prefixed global variable
#7Business Directory Plugin – Easy Listing & Member Directories for WordPress236111,07710k+Non-prefixed global variable
#8RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress239073,808400Request data is not unslashed
#9GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI233,4032,48310k+Output is not escaped
#10Logo Slider – Logo Showcase, Logo Carousel, Logo Gallery and Client Logo Presentation231,08940730k+Text Domain Mismatch
#11IP Geo Block233995898k+Output is not escaped
#12Restaurant Menu and Food Ordering233858292k+Non-prefixed global variable
#13Seriously Simple Podcasting2354763030k+Non-prefixed hook name
#14Media Library Folders2489280710k+Text Domain Mismatch
#15Pz-LinkCard248911,69020k+Non-prefixed global variable
#16Spotlight Social Feeds – Block, Shortcode, and Widget2441114760k+Output is not escaped
#17GEO Plugin by Squirrly SEO241,2381,58530k+Non-prefixed global variable
#18Online Scheduling and Appointment Booking System – Bookly251,16693360k+SQL query is not prepared
#19IP Location Block2540952810k+Output is not escaped
#20MaxGalleria262785602k+Non-prefixed global variable
#21Advanced Shipping Rates for WooCommerce: Flexible Table Rate Shipping Rules281875052k+Non-prefixed global variable
#22ووکامرس فارسی28157215100k+Output is not escaped
#23AppPresser – Mobile App Framework292622141k+Text Domain Mismatch
#24WP Inventory Manager298792601k+Output is not escaped
#25Keywords to Links Converter31288144800Text Domain Mismatch
#26MapPress – Google Maps, OpenStreetMap & Leaflet3270013130k+Missing Arg Domain
#27Related Posts for WordPress3520718010k+Output is not escaped
#28REST API Log35791245k+Non-prefixed hook name
#29Decent Comments3893282k+Output is not escaped
#30Coding Chicken – JetEngine Importer385529300Missing direct file access protection
#31Zippy4043318k+Output is not escaped
#32Gelato Integration for WooCommerce4460275k+Non Singular String Literal Domain
#33Search by SKU for Woocommerce69131010k+Direct Query
#34Vanilla PDF Embed85833k+parse url parse url