WordPress.DB.PreparedSQLPlaceholders.QuotedSimplePlaceholder
Quoted Simple Placeholder
A SQL query is built in a way that Plugin Check cannot verify as safely prepared.
Why It Shows Up
The scan found missing, incorrect, quoted, unsupported, or mismatched SQL placeholders around `$wpdb->prepare()` usage.
Why It Matters
Broken preparation can leave dynamic SQL values unsafe or make queries behave differently than intended.
How to Fix
- Keep placeholders in the SQL string and pass dynamic values as separate arguments.
- Use the placeholder that matches the value type.
- Do not quote placeholders manually, and use allowlists for identifiers or SQL fragments.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #151 | Sitemap by click5 | 25 | 286 | 132 | 6k+ | Unsafe printing function | ||
| #152 | Affiliate Program Suite — SliceWP Affiliates | 25 | 1,291 | 2,089 | 10k+ | Output is not escaped | ||
| #153 | STAGGS – Product Configurator Toolkit | 25 | 626 | 2,180 | 400 | Non-prefixed global variable | ||
| #154 | Survey Maker by AYS | 25 | 567 | 2,397 | 6k+ | Non-prefixed global variable | ||
| #155 | WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards | 25 | 1,431 | 1,270 | 10k+ | Output is not escaped | ||
| #156 | Nested Pages | 25 | 674 | 560 | 90k+ | Non-prefixed global variable | ||
| #157 | Ditty – Responsive News Tickers, Sliders, and Lists | 26 | 561 | 484 | 30k+ | Output is not escaped | ||
| #158 | Media File Renamer: Rename for better SEO (AI-Powered) | 26 | 154 | 170 | 40k+ | Direct Query | ||
| #159 | Organic Builder Widgets – Simple WordPress Page Builder | 26 | 1,034 | 125 | 4k+ | Output is not escaped | ||
| #160 | Paytium: Mollie payment forms & donations | 26 | 506 | 551 | 3k+ | Unsafe printing function | ||
| #161 | Video Gallery – Vimeo and YouTube Gallery | 26 | 561 | 794 | 6k+ | Non-prefixed global variable | ||
| #162 | Ultimate Reviews | 26 | 515 | 345 | 500 | Output is not escaped | ||
| #163 | UpdraftCentral Dashboard | 26 | 267 | 180 | 5k+ | Missing Translators Comment | ||
| #164 | Church Content – Sermons, Events and More | 27 | 134 | 410 | 4k+ | Non-prefixed function | ||
| #165 | Cyrlitera – Transliteration of Links and File Names | 27 | 453 | 204 | 40k+ | Output is not escaped | ||
| #166 | CM Tooltip Glossary | 27 | 611 | 188 | 7k+ | Output is not escaped | ||
| #167 | MaxGalleria | 27 | 278 | 567 | 2k+ | Non-prefixed global variable | ||
| #168 | Theme One Click Demo Importer | 27 | 210 | 157 | 500 | Text Domain Mismatch | ||
| #169 | Tutor LMS – Migration Tool | 27 | 139 | 341 | 1k+ | Direct Query | ||
| #170 | Mihdan: Ajax Edit Comments | 27 | 1,300 | 523 | 400 | Text Domain Mismatch | ||
| #171 | YARPP – Yet Another Related Posts Plugin | 27 | 191 | 331 | 100k+ | Non-prefixed global variable | ||
| #172 | My auctions allegro | 28 | 483 | 235 | 500 | Non Singular String Literal Domain | ||
| #173 | Query Wrangler | 28 | 628 | 229 | 700 | Output is not escaped | ||
| #174 | Secure Downloads | 28 | 616 | 406 | 600 | Output is not escaped | ||
| #175 | WC Fields Factory | 28 | 194 | 369 | 7k+ | Nonce verification recommended | ||
| #176 | 10WebSocial | 28 | 584 | 185 | 10k+ | Unsafe printing function | ||
| #177 | Accordion Slider Gallery | 29 | 379 | 142 | 1k+ | Text Domain Mismatch | ||
| #178 | Businessx Extensions | 29 | 337 | 529 | 1k+ | Non-prefixed function | ||
| #179 | Countdown, Coming Soon, Maintenance – Countdown & Clock | 29 | 1,735 | 143 | 10k+ | Non Singular String Literal Domain | ||
| #180 | WPComplete | 29 | 383 | 333 | 1k+ | Output is not escaped | ||
| #181 | Dynamic Pricing With Discount Rules for WooCommerce | 30 | 136 | 131 | 5k+ | Output is not escaped | ||
| #182 | PublishPress Blocks – Block Controls, Block Visibility, Block Permissions | 30 | 239 | 417 | 20k+ | Non-prefixed global variable | ||
| #183 | aThemes Starter Sites | 30 | 262 | 195 | 40k+ | Text Domain Mismatch | ||
| #184 | FormLift for Keap (Legacy) Web Forms | 30 | 162 | 315 | 400 | Request data is not unslashed | ||
| #185 | گرویتی فرم فارسی | 30 | 205 | 157 | 20k+ | Text Domain Mismatch | ||
| #186 | Pubjet | پابجت | 30 | 91 | 172 | 1k+ | Output is not escaped | ||
| #187 | Dropify | 30 | 130 | 252 | 2k+ | Nonce verification recommended | ||
| #188 | WP Inventory Manager | 30 | 856 | 233 | 1k+ | Output is not escaped | ||
| #189 | WPS Cleaner | 30 | 430 | 491 | 20k+ | Output is not escaped | ||
| #190 | YASR – Yet Another Star Rating Plugin for WordPress | 30 | 252 | 378 | 10k+ | Output is not escaped | ||
| #191 | Advanced Woo Search – Product Search for WooCommerce | 31 | 228 | 377 | 70k+ | Nonce verification recommended | ||
| #192 | Keywords to Links Converter | 31 | 288 | 144 | 700 | Text Domain Mismatch | ||
| #193 | Patreon WordPress | 31 | 276 | 339 | 3k+ | Output is not escaped | ||
| #194 | افزونه پیامک ووکامرس Persian WooCommerce SMS | 31 | 72 | 269 | 40k+ | Nonce verification recommended | ||
| #195 | Portfolio, Gallery, Product Catalog – Grid KIT Portfolio | 31 | 61 | 329 | 6k+ | Non-prefixed global variable | ||
| #196 | Re:amaze Helpdesk & Live Chat | 31 | 96 | 115 | 400 | Output is not escaped | ||
| #197 | WooCommerce Legacy REST API | 31 | 324 | 177 | 400k+ | Missing Translators Comment | ||
| #198 | Tooltips for WordPress | 31 | 312 | 252 | 5k+ | Output is not escaped | ||
| #199 | WP Visitor Statistics (Real Time Traffic) | 31 | 353 | 691 | 20k+ | Nonce verification recommended | ||
| #200 | WPDoctor Malware Scanner & Vulnerability Checker & IP blocker with Hack monitor Lite | 31 | 133 | 438 | 600 | Non-prefixed global variable |
