PluginScore

WordPress.DB.PreparedSQLPlaceholders.ReplacementsWrongNumber

Replacements Wrong Number

A SQL query is built in a way that Plugin Check cannot verify as safely prepared.

critical weight

Why It Shows Up

The scan found missing, incorrect, quoted, unsupported, or mismatched SQL placeholders around `$wpdb->prepare()` usage.

Why It Matters

Broken preparation can leave dynamic SQL values unsafe or make queries behave differently than intended.

How to Fix

  • Keep placeholders in the SQL string and pass dynamic values as separate arguments.
  • Use the placeholder that matches the value type.
  • Do not quote placeholders manually, and use allowlists for identifiers or SQL fragments.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#1404 Solution155821,53210k+Non-prefixed class
#2AnyComment174454495k+Output is not escaped
#3RestroPress – Online Food Ordering System175353,2341k+Non-prefixed global variable
#4Administrator Z182,061799400Output is not escaped
#5Shopping Cart & eCommerce Store188,24018,4783k+Non-prefixed global variable
#6WPPizza – A Restaurant Plugin184,6892,7031k+Text Domain Mismatch
#7Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More202,8741,9881m+Non-prefixed global variable
#8MBE eShip205277401k+Non-prefixed global variable
#9Microthemer Lite – Visual Editor to Customize CSS201,0041,69910k+Non-prefixed global variable
#10Quill Forms | Conversational Multi Step Forms, Surveys & quizzes204003713k+Text Domain Mismatch
#11Membership Plugin – Kadence Memberships205,0893,0059k+Text Domain Mismatch
#12Restrict User Access – Ultimate Membership & Content Protection209771,84810k+Non-prefixed global variable
#13WP Compress – Instant Performance & Speed Optimization204,2923,69110k+Non Singular String Literal Domain
#14Premium Packages – Sell Digital Products Securely202,0432,2992k+Non-prefixed global variable
#15School Management System – WPSchoolPress202455,2851k+Non-prefixed global variable
#16Kadence Security – Password, Two Factor Authentication, and Brute Force Protection211,060959700k+Missing Translators Comment
#17Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots211,6732,18010k+Direct Query
#18Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred211,4363,34510k+Non-prefixed global variable
#19PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI)21502821300Missing direct file access protection
#20SeatReg213501,842300Missing nonce verification
#21Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included211,0813,14740k+Direct Query
#22Buckaroo Payments for WooCommerce216923512k+Exception output is not escaped
#23WCFM Marketplace – Multivendor Marketplace for WooCommerce211,9482,10810k+Non-prefixed global variable
#24CartFlows – Funnel Builder & Checkout Plugin for WooCommerce22459710200k+Non-prefixed global variable
#25WPBot – AI ChatBot for Live Support, Lead Generation, WordPress Automation, AI Services221681,7135k+Non-prefixed global variable
#26Ebook Store224061,076700Non-prefixed global variable
#27Events Manager – Calendar, Bookings, Tickets, and more!224,7125,69060k+Output is not escaped
#28Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI224001,36590k+Non-prefixed global variable
#29GeoDirectory – WP Business Directory Plugin and Classified Listings Directory224,4453,94310k+Output is not escaped
#30If-So Dynamic Content – Elementor & All Page Builders Personalization229698447k+Output is not escaped
#31King Addons for Elementor – 80+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce, Mega Menu, Popup Builder221,8353,89910k+Non-prefixed global variable
#32LearnPress – WordPress LMS Plugin for Create and Sell Online Courses222,3713,61770k+Non-prefixed global variable
#33Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar221,0852,7777k+Non-prefixed global variable
#34MasterStudy LMS WordPress Plugin – for Online Courses and Education221,4504,93810k+Non-prefixed global variable
#35Search Atlas SEO – OTTO AI SEO Automation for WordPress221,4032,8788k+Output is not escaped
#36MotoPress Hotel Booking223,0671,05010k+Text Domain Mismatch
#37Simple Newsletter Plugin – Noptin227359510k+Non-prefixed function
#38Product Catalog Feed by PixelYourSite225813577k+Output is not escaped
#39Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent222265167k+error log error log
#40Welcart e-Commerce2210,34510,86310k+Text Domain Mismatch
#41Easy Appointment Booking & Scheduling System – Webba Booking Calendar221,6663,4712k+Non-prefixed global variable
#42WooCommerce221,3436,2107m+Non-prefixed global variable
#43WP Umbrella: Security Backup Restore & Monitoring221,0011,19180k+Exception output is not escaped
#44SchedulePress – Auto Post & Publish, Auto Social Share, Schedule Posts with Editorial Calendar & Missed Schedule Post Publisher2231625310k+Output is not escaped
#45Product Feed Manager for WooCommerce – RexFeed – Sell on 200+ Shopping Channels232,6933,77110k+slow db query meta key
#46Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More233459485k+Non-prefixed global variable
#47Booking calendar, Appointment Booking System231,0791,1253k+Output is not escaped
#48BuddyPress235849,01290k+Non-prefixed function
#49Business Directory Plugin – Easy Listing & Member Directories for WordPress236111,07710k+Non-prefixed global variable
#50Classified Listing – AI-Powered Classified ads & Business Directory231522,1669k+Non-prefixed global variable