WordPress.DB.PreparedSQLPlaceholders.QuotedSimplePlaceholder
Quoted Simple Placeholder
A SQL query is built in a way that Plugin Check cannot verify as safely prepared.
Why It Shows Up
The scan found missing, incorrect, quoted, unsupported, or mismatched SQL placeholders around `$wpdb->prepare()` usage.
Why It Matters
Broken preparation can leave dynamic SQL values unsafe or make queries behave differently than intended.
How to Fix
- Keep placeholders in the SQL string and pass dynamic values as separate arguments.
- Use the placeholder that matches the value type.
- Do not quote placeholders manually, and use allowlists for identifiers or SQL fragments.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #201 | Yoo Slider – Image Slider & Video Slider | 32 | 744 | 209 | 600 | Output is not escaped | ||
| #202 | Archive Posts Sort Customize | 33 | 338 | 97 | 500 | Output is not escaped | ||
| #203 | Companion Auto Update | 33 | 159 | 298 | 40k+ | Direct Query | ||
| #204 | Companion Sitemap Generator – Simple, Smart, and SEO-Ready | 33 | 118 | 57 | 6k+ | Missing Translators Comment | ||
| #205 | Spiffy Calendar | 33 | 473 | 243 | 2k+ | Output is not escaped | ||
| #206 | Website Monetization by MageNet | 33 | 60 | 87 | 20k+ | Output is not escaped | ||
| #207 | DPD Baltic Shipping | 33 | 99 | 204 | 2k+ | Text Domain Mismatch | ||
| #208 | Pay. Payment Methods for WooCommerce | 33 | 318 | 104 | 3k+ | Non Singular String Literal Domain | ||
| #209 | Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce | 34 | 105 | 287 | 900 | SQL query is not prepared | ||
| #210 | DD Last Viewed | 34 | 193 | 132 | 400 | Output is not escaped | ||
| #211 | FV Gravatar Cache | 34 | 50 | 42 | 600 | Output is not escaped | ||
| #212 | Gratisfaction- Loyalty, Rewards , Referral, Birthday and Giveaway Program | 34 | 131 | 352 | 600 | Missing nonce verification | ||
| #213 | Signature Add-On for Gravity Forms | 34 | 167 | 48 | 1k+ | Text Domain Mismatch | ||
| #214 | One User Avatar | User Profile Picture | 34 | 68 | 190 | 100k+ | Non-prefixed global variable | ||
| #215 | Responsive Menu – Create Mobile-Friendly Menu | 34 | 68 | 44 | 70k+ | Nonce verification recommended | ||
| #216 | Tools for Twitter | 34 | 135 | 87 | 1k+ | Output is not escaped | ||
| #217 | Ultra Companion – Companion plugin for WPoperation Themes | 34 | 73 | 116 | 1k+ | Missing direct file access protection | ||
| #218 | WP Subscription Forms – Subscription Form Plugin for WordPress | 34 | 131 | 220 | 400 | Non-prefixed global variable | ||
| #219 | BlossomThemes Toolkit | 35 | 347 | 52 | 30k+ | Output is not escaped | ||
| #220 | Customizer Backup & Reset | 35 | 8 | 10 | 7k+ | Output is not escaped | ||
| #221 | Gallery Custom Links | 35 | 64 | 57 | 30k+ | Non Singular String Literal Domain | ||
| #222 | HollerBox — Fast & Effective Popups & Lead-Generation | 35 | 77 | 92 | 2k+ | Output is not escaped | ||
| #223 | ReOrder Posts within Categories | 35 | 39 | 207 | 7k+ | Non-prefixed global variable | ||
| #224 | Advance Product Search- Voice & Ajax Search for WooCommerce | 35 | 125 | 91 | 9k+ | Text Domain Mismatch | ||
| #225 | Ultimate Post List | 35 | 186 | 84 | 2k+ | Missing Arg Domain | ||
| #226 | Void Elementor Post Grid Addon for Elementor Page builder | 35 | 189 | 93 | 3k+ | Text Domain Mismatch | ||
| #227 | Custom Body Class | 35 | 39 | 101 | 10k+ | Non-prefixed global variable | ||
| #228 | WP All Import – Property Import for WP Residence | 35 | 41 | 32 | 700 | Output is not escaped | ||
| #229 | REST API Log | 35 | 79 | 124 | 5k+ | Non-prefixed hook name | ||
| #230 | WP Views Counter | 35 | 81 | 42 | 2k+ | Output is not escaped | ||
| #231 | Product Labels For Woocommerce (Sale Badges) | 36 | 90 | 48 | 10k+ | Output is not escaped | ||
| #232 | BP Group Documents | 36 | 27 | 195 | 600 | Non-prefixed global variable | ||
| #233 | Bulk Post Update Date | 36 | 96 | 66 | 10k+ | Unsafe printing function | ||
| #234 | Crelly Slider | 36 | 421 | 185 | 10k+ | Unsafe printing function | ||
| #235 | Events Manager and WPML Compatibility | 36 | 101 | 177 | 1k+ | Direct Query | ||
| #236 | Post Views Stats Counter | 36 | 142 | 241 | 600 | Non-prefixed global variable | ||
| #237 | Sync QCloud COS | 36 | 63 | 109 | 600 | Non-prefixed function | ||
| #238 | WP Custom Cursors | WordPress Cursor Plugin | 36 | 691 | 390 | 8k+ | Text Domain Mismatch | ||
| #239 | CodePeople Post Map for Google Maps | 37 | 257 | 31 | 3k+ | Unsafe printing function | ||
| #240 | NextGEN Scroll Gallery | 37 | 33 | 28 | 1k+ | Output is not escaped | ||
| #241 | Recent Posts Widget With Thumbnails | 37 | 222 | 46 | 100k+ | Output is not escaped | ||
| #242 | RSS Image Feed | 37 | 147 | 16 | 2k+ | Output is not escaped | ||
| #243 | Widget Box Lite | 37 | 318 | 17 | 900 | Output is not escaped | ||
| #244 | Fix Media Library | 37 | 53 | 71 | 1k+ | Output is not escaped | ||
| #245 | YOURLS Link Creator | 37 | 196 | 39 | 500 | Text Domain Mismatch | ||
| #246 | Autologin Links | 38 | 73 | 74 | 7k+ | Output is not escaped | ||
| #247 | Blogger Importer | 38 | 44 | 39 | 50k+ | Output is not escaped | ||
| #248 | Import to Photo Gallery from NextGen gallery | 38 | 80 | 83 | 400 | Direct Query | ||
| #249 | Lana Downloads Manager | 38 | 146 | 78 | 3k+ | Unsafe printing function | ||
| #250 | Podlove Subscribe button | 38 | 148 | 45 | 2k+ | Output is not escaped |
