PluginScore

WordPress.DB.PreparedSQLPlaceholders.QuotedSimplePlaceholder

Quoted Simple Placeholder

A SQL query is built in a way that Plugin Check cannot verify as safely prepared.

critical weight

Why It Shows Up

The scan found missing, incorrect, quoted, unsupported, or mismatched SQL placeholders around `$wpdb->prepare()` usage.

Why It Matters

Broken preparation can leave dynamic SQL values unsafe or make queries behave differently than intended.

How to Fix

  • Keep placeholders in the SQL string and pass dynamic values as separate arguments.
  • Use the placeholder that matches the value type.
  • Do not quote placeholders manually, and use allowlists for identifiers or SQL fragments.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#51Booking calendar, Appointment Booking System231,0791,1253k+Output is not escaped
#52WPBot – AI ChatBot for Live Support, Lead Generation, AI Services235311,2955k+Non-prefixed global variable
#53RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress239223,803500Request data is not unslashed
#54Content Aware Sidebars – Fastest Widget Area Plugin239931,73830k+Non-prefixed global variable
#55Content Egg – Affiliate Product Importer & Price Comparison231,5321,38510k+Non-prefixed global variable
#56Coupon Creator236024241k+Output is not escaped
#57Easy Digital Downloads – eCommerce Payments and Subscriptions made easy233,7028,48640k+Non-prefixed namespace
#58Easy Social Feed – Social Photos Gallery and Post Feed for WordPress231,6811,48830k+Non-prefixed global variable
#59Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light23386999400Non-prefixed global variable
#60FV Flowplayer Video Player231,2801,45610k+Output is not escaped
#61GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress233,6002,77510k+Output is not escaped
#62Groundhogg — CRM, Newsletters, and Marketing Automation231439312k+Non-prefixed global variable
#63Team Members – A WordPress Team Plugin with Gallery, Grid, Carousel, Slider, Table, List, and More231,8402,3102k+Non-prefixed global variable
#64Interactive Content – H5P2356537940k+Non Singular String Literal Domain
#65Payment forms, Buy now buttons, and Invoicing System | GetPaid233921,2685k+Non-prefixed global variable
#66InfiniteWP Client232,3791,844200k+Exception output is not escaped
#67Import WP – Export and Import CSV and XML files to WordPress235793244k+Exception output is not escaped
#68Link Whisper Free233,9445,45630k+Text Domain Mismatch
#69Media Library Assistant231,1303,81370k+Nonce verification recommended
#70Restaurant Menu and Food Ordering233858532k+Non-prefixed global variable
#71Issues and Series for Newspapers, Magazines, Publishers, Writers233457372k+Nonce verification recommended
#72Photo Gallery by 10Web – Mobile-Friendly Image Gallery234,1571,553100k+Output is not escaped
#73AI Popup231,224636400Text Domain Mismatch
#74Schema231,17324540k+Text Domain Mismatch
#75Seraphinite Post .DOCX Source231,156110800Output is not escaped
#76Seriously Simple Podcasting2354763030k+Non-prefixed hook name
#77Local Google Analytics for WordPress – caches external requests235511993k+Output is not escaped
#78Image Optimizer, Resizer and CDN – Sirv236141,0041k+Output is not escaped
#79Slider by 10Web – Responsive Image Slider235,81497610k+Output is not escaped
#80UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP236972,43820k+Non-prefixed hook name
#81Predictive Search for WooCommerce23514633700Output is not escaped
#82ManageWP Worker235015701m+Non-prefixed class
#83WP-CRM System – Manage Clients and Projects232971,094800Non-prefixed global variable
#84FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce237982,19320k+SQL query is not prepared
#85WP STAGING – WordPress Backups, Restore, Migration & Clone231,5451,725100k+Non-prefixed global variable
#86Track, Analyze & Optimize by WP Tao23895756600Output is not escaped
#87WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell236,0192,7735k+Text Domain Mismatch
#88Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress232,3171,7145k+Output is not escaped
#89Ivory Search – WordPress Search Plugin241,1731,688100k+Non-prefixed global variable
#90Popup Box – Create Countdown, Coupon, Video, Contact Form Popups244851,26050k+Non-prefixed global variable
#91BlockMeister – Block Pattern Builder245801,4051k+Non-prefixed global variable
#92Broken Link Checker24693629500k+Output is not escaped
#93WPBot – ChatBot Conversational Forms241,2651,2181k+Text Domain Mismatch
#94Disable Admin Notices – Hide Dashboard Notifications24464195100k+Output is not escaped
#95Etsy Integration For WooCommerce241,2464,643900Non-prefixed global variable
#96FeedWordPress244963199k+Missing Arg Domain
#97Food Store – Online Food Delivery & Pickup248241,9171k+Non-prefixed global variable
#98Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder244,7421,27930k+Non Singular String Literal Domain
#99Assets manager, dequeue scripts, dequeue styles for WordPress245922552k+Output is not escaped
#100Import and export users and customers241,02836070k+Unsafe printing function