PluginScore

WordPress.DB.PreparedSQLPlaceholders.QuotedSimplePlaceholder

Quoted Simple Placeholder

A SQL query is built in a way that Plugin Check cannot verify as safely prepared.

critical weight

Why It Shows Up

The scan found missing, incorrect, quoted, unsupported, or mismatched SQL placeholders around `$wpdb->prepare()` usage.

Why It Matters

Broken preparation can leave dynamic SQL values unsafe or make queries behave differently than intended.

How to Fix

  • Keep placeholders in the SQL string and pass dynamic values as separate arguments.
  • Use the placeholder that matches the value type.
  • Do not quote placeholders manually, and use allowlists for identifiers or SQL fragments.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#1Themify Builder95,3292,1715k+Text Domain Mismatch
#2RestroPress – Online Food Ordering System175273,1891k+Non-prefixed global variable
#3Administrator Z182,061799400Output is not escaped
#4WPPizza – A Restaurant Plugin184,6892,7031k+Text Domain Mismatch
#5Go Fetch Jobs (for WP Job Manager)191,4101,741700Non-prefixed global variable
#6Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps)193,2753,2289k+Output is not escaped
#7Membership Plugin – Kadence Memberships195,0832,9829k+Text Domain Mismatch
#8SendPress Newsletters192,2931,4221k+Output is not escaped
#9Brizy – Page Builder2058672670k+Output is not escaped
#10Download Monitor204231,36480k+Non-prefixed hook name
#11Event Espresso – Event Registration & Ticketing Sales2012,6982,135600Text Domain Mismatch
#12GiveWP – Donation Plugin and Fundraising Platform203,4103,554100k+Output is not escaped
#13Robin Image Optimizer – Unlimited Image Optimization, WebP & AVIF20556543100k+Output is not escaped
#14Events Manager – OpenStreetMaps20559444600Output is not escaped
#15School Management System – WPSchoolPress202455,2851k+Non-prefixed global variable
#16SMS Extension for Contact Form 7217201,387400Non-prefixed global variable
#17EventPrime – Events Calendar, Bookings and Tickets218734,3107k+Non-prefixed global variable
#18Filter Everything — WordPress & WooCommerce Filters2164393350k+Non-prefixed global variable
#19Front End Users217192,759400Non-prefixed global variable
#20MotoPress Hotel Booking213,0671,03710k+Text Domain Mismatch
#21User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor217361,50640k+Nonce verification recommended
#22PublishPress Planner – Editorial Calendar, Marketing Content, Kanban Board216038906k+Output is not escaped
#23URL Shortify – Simple and Easy URL Shortener211,5072,66510k+Non-prefixed global variable
#24WP phpMyAdmin214,5286,43540k+Missing Arg Domain
#2512 Step Meeting List22156593900Non-prefixed global variable
#26Advanced Classifieds & Directory Pro221,2293,5122k+Non-prefixed global variable
#27All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos229122,88520k+Non-prefixed global variable
#28Cart Lift – Abandoned Cart Recovery for WooCommerce and EDD226697691k+Output is not escaped
#29Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer222,8541,26950k+Text Domain Mismatch
#30Directorist: AI-Powered Business Directory, Listings & Classified Ads225602,20220k+Non-prefixed global variable
#31Estatik Real Estate Plugin223,08432510k+Text Domain Mismatch
#32Events Manager – Calendar, Bookings, Tickets, and more!224,7165,69070k+Output is not escaped
#33GeoDirectory – WP Business Directory Plugin and Classified Listings Directory224,4553,97910k+Output is not escaped
#34History Log by click5226751,290400Direct Query
#35If-So Dynamic Content – Elementor & All Page Builders Personalization229698447k+Output is not escaped
#36LearnPress – WordPress LMS Plugin for Create and Sell Online Courses222,4333,59470k+Non-prefixed global variable
#37MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.222,6252,45810k+Output is not escaped
#38Modula Image Gallery – Photo Grid & Video Gallery22474437100k+Text Domain Mismatch
#39MStore API – Create Native Android & iOS Apps On The Cloud226358563k+SQL query is not prepared
#40MultiParcels Shipping For WooCommerce222424224k+Request data is not unslashed
#41myCred Addons – Ultimate myCred Modules To Support WordPress Gamification and Loyalty Rewards222,3441,320400Output is not escaped
#42Product Catalog Feed by PixelYourSite225813578k+Output is not escaped
#43RealPress – Real Estate Plugin226041,167400Non-prefixed global variable
#44Restrict User Access – Ultimate Membership & Content Protection229771,84010k+Non-prefixed global variable
#45Seraphinite Accelerator2259525550k+Output is not escaped
#46WCFM – Frontend Manager for WooCommerce224,7315,05720k+Non-prefixed global variable
#47WCFM Marketplace – Multivendor Marketplace for WooCommerce221,9532,10810k+Non-prefixed global variable
#48Asset CleanUp: Page Speed Booster222,0302,485100k+Non-prefixed global variable
#49WP Umbrella: Security Backup Restore & Monitoring2297099580k+Exception output is not escaped
#50Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce231,1851,0271k+Text Domain Mismatch