PluginScore

WordPress.DB.PreparedSQLPlaceholders.QuotedSimplePlaceholder

Quoted Simple Placeholder

A SQL query is built in a way that Plugin Check cannot verify as safely prepared.

critical weight

Why It Shows Up

The scan found missing, incorrect, quoted, unsupported, or mismatched SQL placeholders around `$wpdb->prepare()` usage.

Why It Matters

Broken preparation can leave dynamic SQL values unsafe or make queries behave differently than intended.

How to Fix

  • Keep placeholders in the SQL string and pass dynamic values as separate arguments.
  • Use the placeholder that matches the value type.
  • Do not quote placeholders manually, and use allowlists for identifiers or SQL fragments.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#1Themify Builder95,2102,1225k+Text Domain Mismatch
#2Podlove Podcast Publisher182,3331,4353k+Output is not escaped
#3RestroPress – Online Food Ordering System185213,0821k+Non-prefixed global variable
#4WPPizza – A Restaurant Plugin184,6892,7031k+Text Domain Mismatch
#5Download Monitor194241,36280k+Non-prefixed hook name
#6Go Fetch Jobs (for WP Job Manager)191,4101,741700Non-prefixed global variable
#7Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps)193,2753,22810k+Output is not escaped
#8Membership Plugin – Kadence Memberships195,0822,9829k+Text Domain Mismatch
#9SendPress Newsletters192,2931,4222k+Output is not escaped
#10Brizy – Page Builder2058972070k+Output is not escaped
#11Event Espresso – Event Registration & Ticketing Sales2012,6982,135600Text Domain Mismatch
#12Filter Everything — WordPress & WooCommerce Filters2056873050k+Output is not escaped
#13GiveWP – Donation Plugin and Fundraising Platform203,4283,559100k+Output is not escaped
#14Link Library201,9411,39710k+Unsafe printing function
#15Robin Image Optimizer – Unlimited Image Optimization, WebP & AVIF20557541100k+Output is not escaped
#16Events Manager – OpenStreetMaps20559444700Output is not escaped
#17School Management System – WPSchoolPress203535,2751k+Non-prefixed global variable
#18SMS Extension for Contact Form 7217201,387400Non-prefixed global variable
#19EventPrime – Events Calendar, Bookings and Tickets218724,3017k+Non-prefixed global variable
#20Front End Users217192,759400Non-prefixed global variable
#21MotoPress Hotel Booking213,0671,03710k+Text Domain Mismatch
#22User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor217011,46550k+Missing Translators Comment
#23PublishPress Planner – Editorial Calendar, Marketing Content, Kanban Board216038906k+Output is not escaped
#24WP phpMyAdmin214,5286,43550k+Missing Arg Domain
#2512 Step Meeting List22156593900Non-prefixed global variable
#26Advanced Classifieds & Directory Pro221,2293,5112k+Non-prefixed global variable
#27All-in-One Video Gallery229112,89220k+Non-prefixed global variable
#28Knowledge Base documentation & wiki plugin – BasePress Docs226711,7672k+Non-prefixed global variable
#29Cart Lift – Abandoned Cart Recovery for WooCommerce and EDD226697691k+Output is not escaped
#30Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer222,8581,27050k+Text Domain Mismatch
#31Directorist: AI-Powered Business Directory, Listings & Classified Ads225492,17220k+Non-prefixed global variable
#32Easy Social Feed – Social Photos Gallery and Post Feed for WordPress221,5671,27730k+Non-prefixed global variable
#33Estatik Real Estate Plugin223,04932510k+Text Domain Mismatch
#34Events Manager – Calendar, Bookings, Tickets, and more!224,7135,66070k+Output is not escaped
#35GeoDirectory – WP Business Directory Plugin and Classified Listings Directory224,4663,97210k+Output is not escaped
#36History Log by click5226751,290400Direct Query
#37InfiniteWP Client222,2861,812200k+Exception output is not escaped
#38Import WP – Export and Import CSV and XML files to WordPress225803304k+Exception output is not escaped
#39LearnPress – WordPress LMS Plugin for Create and Sell Online Courses222,3463,34170k+Non-prefixed global variable
#40MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.222,6252,45810k+Output is not escaped
#41Modula Image Gallery – Photo Grid & Video Gallery22474436100k+Text Domain Mismatch
#42myCred Addons – Ultimate myCred Modules To Support WordPress Gamification and Loyalty Rewards222,3441,320400Output is not escaped
#43Product Catalog Feed by PixelYourSite225813578k+Output is not escaped
#44RealPress – Real Estate Plugin226041,167500Non-prefixed global variable
#45Restrict User Access – Ultimate Membership & Content Protection229771,84010k+Non-prefixed global variable
#46Seraphinite Accelerator2259425550k+Output is not escaped
#47URL Shortify – Simple and Easy URL Shortener221,5202,68910k+Non-prefixed global variable
#48WCFM – Frontend Manager for WooCommerce224,7545,05420k+Non-prefixed global variable
#49WCFM Marketplace – Multivendor Marketplace for WooCommerce221,9341,96610k+Non-prefixed global variable
#50ManageWP Worker225075651m+Non-prefixed class