PluginScore

WordPress.DB.PreparedSQLPlaceholders.ReplacementsWrongNumber

Replacements Wrong Number

A SQL query is built in a way that Plugin Check cannot verify as safely prepared.

critical weight

Why It Shows Up

The scan found missing, incorrect, quoted, unsupported, or mismatched SQL placeholders around `$wpdb->prepare()` usage.

Why It Matters

Broken preparation can leave dynamic SQL values unsafe or make queries behave differently than intended.

How to Fix

  • Keep placeholders in the SQL string and pass dynamic values as separate arguments.
  • Use the placeholder that matches the value type.
  • Do not quote placeholders manually, and use allowlists for identifiers or SQL fragments.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#1AnyComment174454495k+Output is not escaped
#2RestroPress – Online Food Ordering System175243,1551k+Non-prefixed global variable
#3Shopping Cart & eCommerce Store185,37317,4663k+Non-prefixed global variable
#4WPPizza – A Restaurant Plugin184,6892,7031k+Text Domain Mismatch
#5Membership Plugin – Kadence Memberships195,0822,9829k+Text Domain Mismatch
#6MBE eShip205277401k+Non-prefixed global variable
#7Microthemer Lite – Visual Editor to Customize CSS201,0041,69910k+Non-prefixed global variable
#8Premium Packages – Sell Digital Products Securely202,0322,1902k+Non-prefixed global variable
#9School Management System – WPSchoolPress203535,2781k+Non-prefixed global variable
#10Kadence Security – Password, Two Factor Authentication, and Brute Force Protection211,060957700k+Missing Translators Comment
#11Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots211,6212,03310k+Direct Query
#12CartFlows – Funnel Builder & Checkout Plugin for WooCommerce21462656200k+Text Domain Mismatch
#13MotoPress Hotel Booking213,0671,03710k+Text Domain Mismatch
#14Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred211,4783,33710k+Non-prefixed global variable
#15PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI)21485813400Missing direct file access protection
#16Quill Forms | Conversational Multi Step Forms, Surveys & quizzes214013693k+Text Domain Mismatch
#17Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin211,0642,97540k+Direct Query
#18WooCommerce211,3436,2127m+Non-prefixed global variable
#19WP Compress – Instant Performance & Speed Optimization213,3673,25310k+Non Singular String Literal Domain
#20Ebook Store224101,054700Non-prefixed global variable
#21Events Manager – Calendar, Bookings, Tickets, and more!224,7165,69070k+Output is not escaped
#22GeoDirectory – WP Business Directory Plugin and Classified Listings Directory224,4653,97610k+Output is not escaped
#23If-So Dynamic Content – Elementor & All Page Builders Personalization229668397k+Output is not escaped
#24LearnPress – WordPress LMS Plugin for Create and Sell Online Courses222,4333,59470k+Non-prefixed global variable
#25Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization221,3062,8188k+Output is not escaped
#26Product Catalog Feed by PixelYourSite225813578k+Output is not escaped
#27Restrict User Access – Ultimate Membership & Content Protection229771,84010k+Non-prefixed global variable
#28Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent222255198k+error log error log
#29Welcart e-Commerce2210,36810,88210k+Text Domain Mismatch
#30WCFM Marketplace – Multivendor Marketplace for WooCommerce221,9502,10810k+Non-prefixed global variable
#31Easy Appointment Booking & Scheduling System – Webba Booking Calendar221,6173,3802k+Non-prefixed global variable
#32WP Umbrella: Security Backup Restore & Monitoring2297099980k+Exception output is not escaped
#33SchedulePress – Auto Post & Publish, Auto Social Share, Schedule Posts with Editorial Calendar & Missed Schedule Post Publisher2231024910k+Output is not escaped
#34WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell226,0042,7645k+Text Domain Mismatch
#35Booking calendar, Appointment Booking System231,0791,1253k+Output is not escaped
#36BuddyPress235849,01290k+Non-prefixed function
#37Business Directory Plugin – Easy Listing Directories for WordPress236111,06410k+Non-prefixed global variable
#38WPBot – AI ChatBot for Live Support, Lead Generation, AI Services235141,2215k+Non-prefixed global variable
#39Classified Listing – AI-Powered Classified ads & Business Directory231522,1589k+Non-prefixed global variable
#40Content Aware Sidebars – Fastest Widget Area Plugin239931,73830k+Non-prefixed global variable
#41Content Egg – Affiliate Product Importer & Price Comparison231,3001,28710k+Non-prefixed global variable
#42Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe239,35826,4301k+Non-prefixed global variable
#43Easy Digital Downloads – eCommerce Payments and Subscriptions made easy233,71910,28040k+Non-prefixed namespace
#44Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress236531,49650k+Non-prefixed hook name
#45Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI233951,34390k+Non-prefixed global variable
#46Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light23386999400Non-prefixed global variable
#47Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder23407236700k+Text Domain Mismatch
#48GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress233,5902,77110k+Output is not escaped
#49Interactive Content – H5P2356537940k+Non Singular String Literal Domain
#50Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress2392695300k+Non-prefixed namespace