PluginScore

WordPress.DB.PreparedSQLPlaceholders.ReplacementsWrongNumber

Replacements Wrong Number

A SQL query is built in a way that Plugin Check cannot verify as safely prepared.

critical weight

Why It Shows Up

The scan found missing, incorrect, quoted, unsupported, or mismatched SQL placeholders around `$wpdb->prepare()` usage.

Why It Matters

Broken preparation can leave dynamic SQL values unsafe or make queries behave differently than intended.

How to Fix

  • Keep placeholders in the SQL string and pass dynamic values as separate arguments.
  • Use the placeholder that matches the value type.
  • Do not quote placeholders manually, and use allowlists for identifiers or SQL fragments.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsUpdatedTop Issue
#101Events Made Easy255066,2961k+Non Prefixed Function Found
#102HT Contact Form – Drag & Drop Form Builder for WordPress2515859310k+Non Prefixed Variable Found
#103Bulk Page Generator – LPagery256701,9263k+Non Prefixed Variable Found
#104Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails254,6751,4555k+Text Domain Mismatch
#105Media Cleaner: Clean your WordPress!2515139190k+Direct Query
#106NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar2525739740k+Non Prefixed Hookname Found
#107Simply Static – The Static Site Generator2516344630k+Non Prefixed Hookname Found
#108Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management2538793510k+Not Prepared
#109SEO Plugin by Squirrly SEO251,13022240k+Missing Translators Comment
#110Stylish Cost Calculator – Quote Generator, Lead Gen & Price Estimator256471,0161k+Output Not Escaped
#111WP Go Maps – Google Map, OpenStreetMap, Leaflet Map254,9961,008300k+Unsafe Printing Function
#112WP Photo Album Plus2541,79910k+Direct Query
#113Smush – Image Optimization, Compression, Lazy Load, WebP & CDN252525661m+Non Prefixed Hookname Found
#114Easy Appointments2613556910k+Maybe ASPOpen Tag Found
#115Loco Translate264542421m+Output Not Escaped
#116Duplicate Post27447274300k+Unsafe Printing Function
#117Discount Rules and Dynamic Pricing for WooCommerce2818233410k+Output Not Escaped
#118Transliterator – Multilingual and Multi-script Text Conversion283053203k+Output Not Escaped
#119WP ADA Compliance Check Basic287851773k+Text Domain Mismatch
#120AL Pack29138162k+Non Prefixed Variable Found
#121Post Views Counter29179398200k+Non Prefixed Hookname Found
#122Security Ninja – WordPress Security & Firewall291493477k+Direct Query
#123Paymattic – Secure, Simple Payment & Donation with Subscription Payments, Recurring Donations, Customer Management29534964k+Direct Query
#124Xagio SEO – AI Powered SEO2911,26810k+Direct Query
#125Advanced Database Cleaner – Optimize & Clean Database to Speed Up Site Performance30164439100k+Interpolated Not Prepared
#126Edwiser Bridge – WordPress Moodle Integration3046694k+Non Prefixed Hookname Found
#127Anti-spam, Spam protection, ReCaptcha for all forms and GDPR-compliant302642214k+Missing Unslash
#128QA Assistants – Driven by data3048672k+Non Prefixed Variable Found
#129Image Hotspot – Map Image Annotation31952833k+Non Prefixed Variable Found
#130Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker31639336k+Interpolated Not Prepared
#131CartBounty – Save and recover abandoned carts for WooCommerce3337039910k+Output Not Escaped
#132PW WooCommerce Bulk Edit3421914920k+Unsafe Printing Function
#133SOOZ – AI for SEO – Bulk Generate Focus Keyphrases, Metadata, Alt Text (SEO Autopilot)35443942k+Recommended
#134CompressX — AVIF & WebP Converter, Media Replacement352642340k+Missing
#135Elementor Website Builder – more than just a page builder354642810m+Non Prefixed Variable Found
#136MetaSlider Gallery – Image Gallery, Lightbox Galleries, Modal Windows351574910k+Output Not Escaped
#137Recurio – Ultimate Subscription for WooCommerce35413001k+Direct Query
#138Yabe Webfont – Use Custom Fonts, Google Fonts or Adobe Fonts35481145k+Non Prefixed Hookname Found
#139Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder36332110k+Recommended
#140Desktop Mode3615792k+Direct Query
#141Product Badge, Label, Countdown Timer for WooCommerce – Sale Booster3837985k+Interpolated Not Prepared
#142MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites383136700k+Non Prefixed Hookname Found
#143WholesaleX – B2B & Wholesale Plugin for WooCommerce with Wholesale Prices38401802k+Non Prefixed Variable Found
#144CatFolders Document Gallery & PDF Library3966323k+Output Not Escaped
#145Markup by Attribute for WooCommerce39461022k+Direct Query
#146Traffic Monitor3961431k+Direct Query
#147Website LLMs.txt391314540k+Non Prefixed Variable Found
#148Alt Magic: AI Image Alt Text Generator for WP & Image Rename40551181k+Direct Query
#149Broken Link Notifier40111931k+Non Prefixed Variable Found
#150Simple Lightbox412148100k+Recommended