PluginScore

WordPress.DB.PreparedSQLPlaceholders.ReplacementsWrongNumber

Replacements Wrong Number

A SQL query is built in a way that Plugin Check cannot verify as safely prepared.

critical weight

Why It Shows Up

The scan found missing, incorrect, quoted, unsupported, or mismatched SQL placeholders around `$wpdb->prepare()` usage.

Why It Matters

Broken preparation can leave dynamic SQL values unsafe or make queries behave differently than intended.

How to Fix

  • Keep placeholders in the SQL string and pass dynamic values as separate arguments.
  • Use the placeholder that matches the value type.
  • Do not quote placeholders manually, and use allowlists for identifiers or SQL fragments.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsUpdatedTop Issue
#1AnyComment174454495k+Output Not Escaped
#2Shopping Cart & eCommerce Store185,45917,2984k+Non Prefixed Variable Found
#3Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization191,2952,6799k+Output Not Escaped
#4Membership Plugin – Kadence Memberships195,0822,9829k+Text Domain Mismatch
#5BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot205081,40630k+Non Prefixed Variable Found
#6Microthemer Lite – Visual Editor to Customize CSS201,0041,69910k+Non Prefixed Variable Found
#7Quill Forms | Conversational Multi Step Forms, Surveys & quizzes204013683k+Text Domain Mismatch
#8CartFlows – Funnel Builder & Checkout Plugin for WooCommerce21461614200k+Text Domain Mismatch
#9MotoPress Hotel Booking213,0611,03710k+Text Domain Mismatch
#10Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred211,4693,33310k+Non Prefixed Variable Found
#11Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots221,6042,01910k+Direct Query
#12BuddyPress225839,008100k+Non Prefixed Function Found
#13Events Manager – Calendar, Bookings, Tickets, and more!224,7225,62170k+Output Not Escaped
#14Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder22409236700k+Text Domain Mismatch
#15GeoDirectory – WP Business Directory Plugin and Classified Listings Directory224,4623,97210k+Output Not Escaped
#16LearnPress – WordPress LMS Plugin for Create and Sell Online Courses222,3613,38470k+Non Prefixed Variable Found
#17Product Catalog Feed by PixelYourSite225813578k+Output Not Escaped
#18Restrict User Access – Ultimate Membership & Content Protection229771,84010k+Non Prefixed Variable Found
#19Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent222255198k+error log error log
#20Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin225302,33440k+Direct Query
#21Welcart e-Commerce2210,37710,89610k+Text Domain Mismatch
#22WCFM Marketplace – Multivendor Marketplace for WooCommerce221,9371,96910k+Non Prefixed Variable Found
#23WooCommerce221,3556,1297m+Non Prefixed Variable Found
#24WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell225,9962,7905k+Text Domain Mismatch
#25School Management System – WPSchoolPress223145,2201k+Non Prefixed Variable Found
#26Kadence Security – Password, Two Factor Authentication, and Brute Force Protection231,053967700k+Missing Translators Comment
#27Booking calendar, Appointment Booking System231,0791,1254k+Output Not Escaped
#28Business Directory Plugin – Easy Listing Directories for WordPress236111,05810k+Non Prefixed Variable Found
#29WPBot – AI ChatBot for Live Support, Lead Generation, AI Services232641,0185k+Non Prefixed Variable Found
#30Content Aware Sidebars – Fastest Widget Area Plugin239931,73830k+Non Prefixed Variable Found
#31Content Egg – Affiliate Product Importer & Price Comparison231,2311,25710k+Non Prefixed Variable Found
#32Easy Digital Downloads – eCommerce Payments and Subscriptions made easy233,72310,28340k+Non Prefixed Namespace Found
#33Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI233951,34290k+Non Prefixed Variable Found
#34GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress233,6622,97110k+Output Not Escaped
#35Groundhogg — CRM, Newsletters, and Marketing Automation231529502k+Non Prefixed Variable Found
#36Interactive Content – H5P2356538040k+Non Singular String Literal Domain
#37Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress2391693300k+Non Prefixed Namespace Found
#38King Addons for Elementor – 80+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce, Mega Menu, Popup Builder231,8373,87810k+Non Prefixed Variable Found
#39Masteriyo LMS – LMS Course Builder, Quizzes & Certificates231971,7485k+Non Prefixed Variable Found
#40Link Whisper Free233,8825,30330k+Text Domain Mismatch
#41MasterStudy LMS WordPress Plugin – for Online Courses and Education231,4194,87510k+Non Prefixed Variable Found
#42Ninja Forms – The Contact Form Builder That Grows With You237551,536600k+Recommended
#43Photo Gallery by 10Web – Mobile-Friendly Image Gallery234,1591,553100k+Output Not Escaped
#44The Events Calendar233,5123,848700k+Text Domain Mismatch
#45Visitor Traffic Real Time Statistics2342990530k+Direct Query
#46Advanced Booking & Appointment System – Webba Booking Calendar231,6153,3002k+Non Prefixed Variable Found
#47ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin237,4232,18190k+Text Domain Mismatch
#48WP Compress – Instant Performance & Speed Optimization233,0532,38410k+Non Singular String Literal Domain
#49FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce231,1252,15320k+missing direct file access protection
#50Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning231,11820240k+Missing Translators Comment