PluginScore

WordPress.DB.PreparedSQLPlaceholders.QuotedSimplePlaceholder

Quoted Simple Placeholder

A SQL query is built in a way that Plugin Check cannot verify as safely prepared.

critical weight

Why It Shows Up

The scan found missing, incorrect, quoted, unsupported, or mismatched SQL placeholders around `$wpdb->prepare()` usage.

Why It Matters

Broken preparation can leave dynamic SQL values unsafe or make queries behave differently than intended.

How to Fix

  • Keep placeholders in the SQL string and pass dynamic values as separate arguments.
  • Use the placeholder that matches the value type.
  • Do not quote placeholders manually, and use allowlists for identifiers or SQL fragments.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#101Social Slider Feed – Social Media Feed & Gallery Widgets2492770610k+Non-prefixed global variable
#102Media Library Folders2489280710k+Text Domain Mismatch
#103Ninja Forms – The Contact Form Builder That Grows With You247521,599600k+Nonce verification recommended
#104Patchstack – WordPress & Plugins Security2410447850k+Missing nonce verification
#105Podlove Podcast Publisher242,1071,3993k+Output is not escaped
#106Poll Maker by AYS – Versus Polls, Anonymous Polls, Image Polls244881,4157k+Non-prefixed global variable
#107Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors2436982020k+Nonce verification recommended
#108Quiz Maker by AYS245023,05420k+Non-prefixed global variable
#109PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes2442260110k+Missing Translators Comment
#110SecuPress with Simple SSL – Simple and Performant Security241,6951,60040k+Non-prefixed global variable
#111Security Plugin, Firewall & Malware Scanner with Auto Removal241,15681340k+SQL query is not prepared
#112Shortcodes Ultimate – Content Elements246561,552400k+Non-prefixed global variable
#113SiteOrigin Widgets Bundle24605455400k+Output is not escaped
#114Survey Maker by AYS245662,4015k+Non-prefixed global variable
#115Team Members – Multi Language Supported Team Plugin242,08111,2077k+Non-prefixed global variable
#116Timber248512820k+Non-prefixed hook name
#117Ultimate Product Catalog245545224k+Unsafe printing function
#118Disable Updates – Updates Manager, Disable Automatic Updates, Disable All Updates2452113410k+Output is not escaped
#119WPML Multilingual & Multicurrency for WooCommerce241,5991,691100k+SQL query is not prepared
#120Asset CleanUp: Page Speed Booster241,5413,462100k+Non-prefixed global variable
#121Auto Affiliate Links243994103k+Output is not escaped
#122WP-Members Membership Plugin2466938250k+Output is not escaped
#123WP Notification Bell247361,591700Non-prefixed global variable
#124WP-Stateless – Google Cloud Storage241,0364824k+Non Singular String Literal Domain
#125WP Travel Engine – Tour Booking Plugin – Tour Operator Software242,0375,72420k+Non-prefixed global variable
#126WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import241,1963,89820k+Direct Query
#127Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress242,5822,109100k+Output is not escaped
#128WPeMatico RSS Feed Fetcher241,38758610k+Output is not escaped
#129Photo Engine (Media Organizer & Lightroom)242536452k+Direct Query
#130YMC Filter24171,7334k+Non-prefixed global variable
#131Dynamic Pricing With Discount Rules for WooCommerce251652055k+Non-prefixed global variable
#132AdRotate Banner Manager251,35784620k+Unsafe printing function
#133bbp style pack251,4191,7916k+Output is not escaped
#134Booking Package251,6983,97810k+Missing nonce verification
#135Disable Comments & Delete All Comments255021849k+Output is not escaped
#136CP Contact Form with PayPal25467941800Unsafe printing function
#137Docket Cache – Object Cache Accelerator2533348120k+Output is not escaped
#138胖鼠采集(Fat Rat Collect)25630190800Missing Arg Domain
#139Simple Giveaways – Grow your business, email lists and traffic with contests259562,384400Non-prefixed global variable
#140MaxButtons – Create buttons2562640470k+Output is not escaped
#141Media Cleaner: Clean your WordPress!2526756890k+Direct Query
#142Participants Database259418937k+SQL query is not prepared
#143Post Snippets – Custom WordPress Code Snippets Customizer258031,65520k+Non-prefixed global variable
#144Premmerce Product Search for WooCommerce255961,350900Non-prefixed global variable
#145Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker253812,62140k+Non-prefixed hook name
#146reSmush.it : The original free image compressor and optimizer plugin2515569100k+Output is not escaped
#147Sitemap by click5252861326k+Unsafe printing function
#148Affiliate Program Suite — SliceWP Affiliates251,2912,08910k+Output is not escaped
#149STAGGS – Product Configurator Toolkit256262,180400Non-prefixed global variable
#150Cyrlitera – Transliteration of Links and File Names2645220240k+Output is not escaped