PluginScore

WordPress.DB.PreparedSQLPlaceholders.ReplacementsWrongNumber

Replacements Wrong Number

A SQL query is built in a way that Plugin Check cannot verify as safely prepared.

critical weight

Why It Shows Up

The scan found missing, incorrect, quoted, unsupported, or mismatched SQL placeholders around `$wpdb->prepare()` usage.

Why It Matters

Broken preparation can leave dynamic SQL values unsafe or make queries behave differently than intended.

How to Fix

  • Keep placeholders in the SQL string and pass dynamic values as separate arguments.
  • Use the placeholder that matches the value type.
  • Do not quote placeholders manually, and use allowlists for identifiers or SQL fragments.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsUpdatedTop Issue
#51Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning231,11820240k+Missing Translators Comment
#52WPMobile.App232,9831,5273k+Output Not Escaped
#53Photo Engine (Media Organizer & Lightroom)232526502k+Direct Query
#54404 Solution244831,08710k+Missing Unslash
#55Academy LMS – WordPress LMS Plugin for Complete eLearning Solution241627872k+Non Prefixed Variable Found
#56Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More243429306k+Non Prefixed Variable Found
#57Bulk Edit Categories and Tags – Create Thousands Quickly on the Editor241,0259844k+Text Domain Mismatch
#58Bulk Edit and Create User Profiles – WP Sheet Editor249799691k+Text Domain Mismatch
#59SilentShield – Captcha & Anti-Spam for WordPress (CF7, WPForms, Elementor, WooCommerce)2423621410k+Unescaped DBParameter
#60Customer Reviews for WooCommerce242,2062,44380k+Output Not Escaped
#61Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress246521,49560k+Non Prefixed Hookname Found
#62Fix Alt Text245443461k+Non Singular String Literal Domain
#63FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution2419374780k+Direct Query
#64Gallery by BestWebSoft – Customizable Image and Photo Galleries for WordPress2453632410k+Text Domain Mismatch
#65Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN243,41086670k+Text Domain Mismatch
#66Koko Analytics – Privacy-Friendly WordPress Analytics2416128060k+Echo Found
#67LearnPress – Backup & Migration Tool243854695k+Output Not Escaped
#68LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes244141,17710k+Non Prefixed Variable Found
#69Event Booking Manager for WooCommerce249561,9647k+Non Prefixed Variable Found
#70MxChat – AI Chatbot & Content Generation for WordPress243,1571,3852k+Text Domain Mismatch
#71Simple Newsletter Plugin – Noptin246659110k+Non Prefixed Variable Found
#72Participants Database249518947k+Not Prepared
#73SEO Engine – Smart SEO with AI, Schema & Redirection for WordPress242363041k+Direct Query
#74Simple Membership242,3731,78940k+Unsafe Printing Function
#75Smart Image Resize – Make WooCommerce Images the Same Size245163797k+Text Domain Mismatch
#76Sokol: Smart WooCommerce Search245991,5516k+Non Prefixed Variable Found
#77Stripe Payment Forms by WP Simple Pay – Accept Credit Card Payments + Subscriptions with Stripe246346529k+Exception Not Escaped
#78Sugar Calendar – Events Calendar, Event Tickets, and Events Management Platform2442895610k+Output Not Escaped
#79Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System245898972k+Non Prefixed Variable Found
#80SureForms – Drag & Drop Contact Form & Form Builder, Payment Form, Survey, Quiz & Calculator24351250500k+Text Domain Mismatch
#81Team Members – Multi Language Supported Team Plugin242,08111,2067k+Non Prefixed Variable Found
#82Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud!24167222400k+Recommended
#83User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder246643,31860k+Non Prefixed Variable Found
#84Bulk Edit Products for WooCommerce – WP Sheet Editor2494193610k+Text Domain Mismatch
#85Coupon Affiliates – Affiliate Plugin for WooCommerce241,0223,0745k+Non Prefixed Variable Found
#86NextMove Lite – Thank You Page for WooCommerce2491685710k+Non Prefixed Variable Found
#87WPML Multilingual & Multicurrency for WooCommerce241,4531,618100k+Not Prepared
#88Yoast SEO – Advanced SEO with real-time guidance and built-in AI2415938610m+Non Prefixed Variable Found
#89WP Layouts243491463k+Text Domain Mismatch
#90WP-Members Membership Plugin2466938250k+Output Not Escaped
#91WP Recipe Maker2448192650k+Non Prefixed Variable Found
#92SchedulePress – Auto Post & Publish, Auto Social Share, Schedule Posts with Editorial Calendar & Missed Schedule Post Publisher2429624510k+Output Not Escaped
#93Bulk Edit Posts and Products in Spreadsheet249189129k+Text Domain Mismatch
#94SlimStat Analytics241,16973770k+Exception Not Escaped
#95WSMS (formerly WP SMS) – SMS & MMS Notifications with OTP and 2FA for WooCommerce24911,7257k+Non Prefixed Hookname Found
#96WP Travel Engine – Tour Booking Plugin – Tour Operator Software242,0105,68820k+Non Prefixed Variable Found
#97All 404 Redirect to Homepage25140301200k+date date
#98Animated Number Counters254081,9492k+Non Prefixed Variable Found
#99Booking Package251,7003,97710k+Missing
#100Online Scheduling and Appointment Booking System – Bookly253,52887060k+Text Domain Mismatch