WordPress.DB.PreparedSQLPlaceholders.QuotedSimplePlaceholder
Quoted Simple Placeholder
A SQL query is built in a way that Plugin Check cannot verify as safely prepared.
Why It Shows Up
The scan found missing, incorrect, quoted, unsupported, or mismatched SQL placeholders around `$wpdb->prepare()` usage.
Why It Matters
Broken preparation can leave dynamic SQL values unsafe or make queries behave differently than intended.
How to Fix
- Keep placeholders in the SQL string and pass dynamic values as separate arguments.
- Use the placeholder that matches the value type.
- Do not quote placeholders manually, and use allowlists for identifiers or SQL fragments.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #251 | Widget Box Lite | 37 | 318 | 17 | 900 | Output is not escaped | ||
| #252 | Fix Media Library | 37 | 53 | 71 | 1k+ | Output is not escaped | ||
| #253 | YOURLS Link Creator | 37 | 196 | 39 | 500 | Text Domain Mismatch | ||
| #254 | Autologin Links | 38 | 73 | 74 | 8k+ | Output is not escaped | ||
| #255 | Blogger Importer | 38 | 44 | 39 | 50k+ | Output is not escaped | ||
| #256 | Import to Photo Gallery from NextGen gallery | 38 | 80 | 83 | 400 | Direct Query | ||
| #257 | Lana Downloads Manager | 38 | 146 | 78 | 3k+ | Unsafe printing function | ||
| #258 | Podlove Subscribe button | 38 | 148 | 45 | 2k+ | Output is not escaped | ||
| #259 | WP Accessibility Helper (WAH) | 38 | 61 | 88 | 10k+ | Missing direct file access protection | ||
| #260 | Responsive Vertical Icon Menu | 38 | 188 | 85 | 800 | Output is not escaped | ||
| #261 | Cache Images | 39 | 72 | 27 | 1k+ | Unsafe printing function | ||
| #262 | Calculator Builder – Create an Online Calculator | 39 | 16 | 221 | 1k+ | Non-prefixed global variable | ||
| #263 | Image CAPTCHA for Contact Form 7 and WPForms by HookAndHook (DSGVO/GDPR) | 39 | 28 | 45 | 80k+ | Missing nonce verification | ||
| #264 | Fix Duplicates | 39 | 76 | 73 | 800 | Output is not escaped | ||
| #265 | Paystack Add-On for Gravity Forms | 39 | 96 | 31 | 400 | Text Domain Mismatch | ||
| #266 | Quform Mailchimp | 39 | 65 | 147 | 800 | Nonce verification recommended | ||
| #267 | Quform Zapier | 39 | 60 | 123 | 1k+ | Nonce verification recommended | ||
| #268 | Responsify WP | 39 | 90 | 11 | 600 | Unsafe printing function | ||
| #269 | WP Most Popular | 39 | 50 | 35 | 2k+ | Output is not escaped | ||
| #270 | WP Sitemaps Config | 39 | 88 | 37 | 700 | Output is not escaped | ||
| #271 | Enhanced Custom Permalinks | 40 | 51 | 82 | 1k+ | Nonce verification recommended | ||
| #272 | Random Banner | 40 | 59 | 125 | 1k+ | Output is not escaped | ||
| #273 | Visibility Control for LearnDash | 40 | 55 | 23 | 1k+ | Missing Arg Domain | ||
| #274 | Zippy | 40 | 43 | 31 | 9k+ | Output is not escaped | ||
| #275 | OSS Aliyun | 41 | 19 | 40 | 3k+ | Request data is not unslashed | ||
| #276 | Companion Revision Manager – Revision Control | 42 | 18 | 28 | 4k+ | Unsafe printing function | ||
| #277 | Custom Taxonomy Order | 42 | 20 | 56 | 50k+ | Output is not escaped | ||
| #278 | User Role Editor | 43 | 117 | 145 | 700k+ | Output is not escaped | ||
| #279 | Tabby Checkout | 47 | 33 | 46 | 4k+ | Non-prefixed class | ||
| #280 | Secondary Product Image for WooCommerce | 49 | 25 | 29 | 2k+ | Output is not escaped | ||
| #281 | Multiple Post Thumbnails | 53 | 25 | 18 | 20k+ | Output is not escaped | ||
| #282 | Topic SEO Content Optimization Tool | 62 | 35 | 15 | 1k+ | curl curl close | ||
| #283 | Classic Editor and Classic Widgets | 63 | 18 | 41 | 20k+ | Nonce verification recommended | ||
| #284 | WP REST API Controller | 64 | 8 | 22 | 8k+ | Nonce verification recommended | ||
| #285 | Dashboard Directory Size | 65 | 32 | 9 | 400 | Missing Arg Domain | ||
| #286 | Bitrix24 | 65 | 28 | 10 | 500 | Text Domain Mismatch | ||
| #287 | WP Sanitize Accented Uploads | 68 | 15 | 16 | 800 | Quoted Simple Placeholder | ||
| #288 | Cognito Forms | 75 | 13 | 4 | 2k+ | wp function not compatible with requires wp | ||
| #289 | Simple Taxonomy Ordering | 75 | 7 | 10 | 20k+ | Direct Query | ||
| #290 | Discounts Per Payment Method on WooCommerce | 80 | 8 | 8 | 1k+ | Missing Translators Comment | ||
| #291 | Change Permalink Helper | 81 | 5 | 5 | 900 | Direct Query | ||
| #292 | WPLMS CoAuthors Plus | 92 | 3 | 4 | 1k+ | trademarked term |
