PluginScore

WordPress.DB.PreparedSQLPlaceholders.LikeWithoutWildcards

Like Without Wildcards

A SQL query is built in a way that Plugin Check cannot verify as safely prepared.

critical weight

Why It Shows Up

The scan found missing, incorrect, quoted, unsupported, or mismatched SQL placeholders around `$wpdb->prepare()` usage.

Why It Matters

Broken preparation can leave dynamic SQL values unsafe or make queries behave differently than intended.

How to Fix

  • Keep placeholders in the SQL string and pass dynamic values as separate arguments.
  • Use the placeholder that matches the value type.
  • Do not quote placeholders manually, and use allowlists for identifiers or SQL fragments.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#1LearnPress – WordPress LMS Plugin for Create and Sell Online Courses222,4333,59470k+Non-prefixed global variable
#2Swift Performance Lite222,3461,3256k+Text Domain Mismatch
#3Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light23386999400Non-prefixed global variable
#4FunnelKit – Funnel Builder for WooCommerce Checkout231,5412,31930k+Non-prefixed global variable
#5FV Flowplayer Video Player231,3111,45410k+Output is not escaped
#6FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce237982,19320k+SQL query is not prepared
#7WP Hotel Booking249011,5327k+Non-prefixed global variable
#8TrackShip for WooCommerce254059546k+Non-prefixed global variable
#9Transliterator – Multilingual and Multi-script Text Conversion283053223k+Output is not escaped
#10WP GPX Maps35271004k+Non-prefixed global variable
#11Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories4863273100k+Non-prefixed global variable
#12wp-Monalisa485694700Direct Query