PluginScore

WordPress.DB.PreparedSQLPlaceholders.ReplacementsWrongNumber

Replacements Wrong Number

A SQL query is built in a way that Plugin Check cannot verify as safely prepared.

critical weight

Why It Shows Up

The scan found missing, incorrect, quoted, unsupported, or mismatched SQL placeholders around `$wpdb->prepare()` usage.

Why It Matters

Broken preparation can leave dynamic SQL values unsafe or make queries behave differently than intended.

How to Fix

  • Keep placeholders in the SQL string and pass dynamic values as separate arguments.
  • Use the placeholder that matches the value type.
  • Do not quote placeholders manually, and use allowlists for identifiers or SQL fragments.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#151Security Ninja – WordPress Security & Firewall291493477k+Direct Query
#152SureForms – Drag & Drop Contact Form & Form Builder, Payment Form, Survey, Quiz & Calculator29336198500k+Text Domain Mismatch
#153Xagio SEO – AI Powered SEO2921,27310k+Direct Query
#154Advanced Database Cleaner – Optimize & Clean Database to Speed Up Site Performance30164439100k+Interpolated SQL is not prepared
#155AI Product Tools – Bulk Product Content Generator & AI Toolkit for WooCommerce30508562400SQL query is not prepared
#156Custom Search by BestWebSoft – WordPress Custom Search Plugin30454228900Text Domain Mismatch
#157Edwiser Bridge – WordPress Moodle Integration3046694k+Non-prefixed hook name
#158Anti-spam, Spam protection, ReCaptcha for all forms and GDPR-compliant302642214k+Non Singular String Literal Text
#159Nova Blocks by Pixelgrade30206112800Output is not escaped
#160QA Assistants – Driven by data3048672k+Non-prefixed global variable
#161SEO合集(支持百度/Google/Bing/头条推送)31131,407800Direct Query
#162Image Hotspot – Map Image Annotation31952873k+Non-prefixed global variable
#163Interactive Image Map Builder311603811k+Non-prefixed global variable
#164Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker31639356k+Interpolated SQL is not prepared
#165Return Refund and Exchange For WooCommerce31247134k+Non-prefixed global variable
#166ActiveDEMAND321571611k+Output is not escaped
#167MetaSlider Gallery – Image Gallery, Lightbox Galleries, Modal Windows321596210k+Output is not escaped
#168WP Bannerize Pro32281216800Text Domain Mismatch
#169Comments – GraphComment | AI-Moderated Comment System33191177400Unsafe printing function
#170Nomad World Map33424191700Text Domain Mismatch
#171CartBounty – Save and recover abandoned carts for WooCommerce3337039910k+Output is not escaped
#172Paymattic – Secure, Simple Payment & Donation with Subscription Payments, Recurring Donations, Customer Management335383k+Direct Query
#173PW WooCommerce Bulk Edit3421914920k+Unsafe printing function
#174Security Safe34193164700Missing Translators Comment
#175CompressX — AVIF & WebP Converter, Media Replacement352642340k+Missing nonce verification
#176Elementor Website Builder – more than just a page builder354642810m+Non-prefixed global variable
#177FooGallery Migrate35412321k+Non-prefixed global variable
#178g-FFL Cockpit3518224500Direct Query
#179StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More35519600Non-prefixed global variable
#180Yabe Webfont – Use Custom Fonts, Google Fonts or Adobe Fonts35481145k+Non-prefixed hook name
#181SOOZ – AI for SEO – Bulk Generate Focus Keyphrases, Metadata, Alt Text (SEO Autopilot)3643422k+Nonce verification recommended
#182Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder36332210k+Nonce verification recommended
#183Desktop Mode3615872k+Direct Query
#184GetPaid > Wallet36149174700Text Domain Mismatch
#185Product Badge, Label, Countdown Timer for WooCommerce – Sale Booster3837985k+Interpolated SQL is not prepared
#186MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites383136700k+Non-prefixed hook name
#187WholesaleX – B2B & Wholesale Plugin for WooCommerce with Wholesale Prices38331812k+Non-prefixed global variable
#188Better User Search392444700SQL query is not prepared
#189CatFolders Document Gallery & PDF Library3966323k+Output is not escaped
#190Markup by Attribute for WooCommerce39461022k+Direct Query
#191Traffic Monitor3961431k+Direct Query
#192Website LLMs.txt391314540k+Non-prefixed global variable
#193Alt Magic: AI Image Alt Text Generator for WP & Image Rename40551181k+Direct Query
#194Broken Link Notifier40111931k+Non-prefixed global variable
#195Search Live4013271600Output is not escaped
#196CMS Tree Page View – Reorder Pages with a Drag-and-Drop Tree411219650k+Unsafe printing function
#197Simple Lightbox412148100k+Nonce verification recommended
#198Term Management Tools4392610k+Non-prefixed hook name
#199WP Mail Log43402910k+Text Domain Mismatch
#200JetHost Total Care – Security & Enhancements451085800Direct Query