PluginScore

WordPress.DB.PreparedSQLPlaceholders.UnfinishedPrepare

Unfinished Prepare

A SQL query is built in a way that Plugin Check cannot verify as safely prepared.

critical weight

Why It Shows Up

The scan found missing, incorrect, quoted, unsupported, or mismatched SQL placeholders around `$wpdb->prepare()` usage.

Why It Matters

Broken preparation can leave dynamic SQL values unsafe or make queries behave differently than intended.

How to Fix

  • Keep placeholders in the SQL string and pass dynamic values as separate arguments.
  • Use the placeholder that matches the value type.
  • Do not quote placeholders manually, and use allowlists for identifiers or SQL fragments.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#1404 Solution155821,53210k+Non-prefixed class
#2AnyComment174454495k+Output is not escaped
#3RestroPress – Online Food Ordering System175353,2341k+Non-prefixed global variable
#4Shopping Cart & eCommerce Store177,49217,5543k+Non-prefixed global variable
#5wpForo Forum174,2923,02620k+Unsafe printing function
#6Administrator Z182,061799400Output is not escaped
#7Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution181,229923100k+Exception output is not escaped
#8WPPizza – A Restaurant Plugin184,6892,7031k+Text Domain Mismatch
#9GiveWP – Donation Plugin and Fundraising Platform193,4023,555100k+Output is not escaped
#10SendPress Newsletters192,2931,4221k+Output is not escaped
#11Brizy – Page Builder2058572660k+Output is not escaped
#12Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More202,8781,9881m+Non-prefixed global variable
#13Microthemer Lite – Visual Editor to Customize CSS201,0041,69910k+Non-prefixed global variable
#14Membership Plugin – Kadence Memberships205,0893,0059k+Text Domain Mismatch
#15Premium Packages – Sell Digital Products Securely202,0432,2992k+Non-prefixed global variable
#16School Management System – WPSchoolPress202455,2851k+Non-prefixed global variable
#17Forumax – AI Powered Advanced Community Forum Plugin214,9314,352600Text Domain Mismatch
#18Kadence Security – Password, Two Factor Authentication, and Brute Force Protection211,060959700k+Missing Translators Comment
#19Pinpoint Booking System – Version 2216343283k+Missing direct file access protection
#20Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots211,6732,17910k+Direct Query
#21Event Espresso – Event Registration & Ticketing Sales2112,7102,136600Text Domain Mismatch
#22Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More21562,148300k+Non-prefixed global variable
#23King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder211,8493,90410k+Non-prefixed global variable
#24Mooberry Book Manager211,0403991k+Text Domain Mismatch
#25Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred211,4363,34510k+Non-prefixed global variable
#26Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction211,9945,33110k+Non-prefixed hook name
#27PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI)21502823300Missing direct file access protection
#28Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included211,0813,14740k+Direct Query
#29WCFM – Frontend Manager for WooCommerce214,7145,05920k+Non-prefixed global variable
#30WCFM Marketplace – Multivendor Marketplace for WooCommerce211,9482,10810k+Non-prefixed global variable
#31Wise Chat214705155k+Output is not escaped
#32Wordfence Security – Firewall, Malware Scan, and Login Security211,8933,2925m+Output is not escaped
#33wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin211,8291,53460k+Output is not escaped
#34WPScan – WordPress Security Scanner215272658k+Text Domain Mismatch
#35CartFlows – Funnel Builder & Checkout Plugin for WooCommerce22459710200k+Non-prefixed global variable
#36Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer222,8541,26940k+Text Domain Mismatch
#37RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login223,6555,1607k+Non-prefixed global variable
#38Directorist: AI-Powered Business Directory, Listings & Classified Ads224862,32720k+Non-prefixed global variable
#39Double Opt-In for Contact Form 7 – Secure, GDPR-Compliant Email Verification223524911k+SQL query is not prepared
#40Free Downloads WooCommerce224283524k+Output is not escaped
#41E2Pdf – Export Pdf Tool for WordPress221,08185210k+Unsafe printing function
#42Easy Digital Downloads – eCommerce Payments and Subscriptions made easy223,7138,57340k+Non-prefixed namespace
#43ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce228305,9785k+Direct Query
#44Events Maker by dFactory225888191k+Output is not escaped
#45Events Manager – Calendar, Bookings, Tickets, Appointments and more!224,7305,71460k+Output is not escaped
#46FACTO – Facturación Electrónica22258450300Request data is not unslashed
#47Frontend Dashboard22375941500Non-prefixed function
#48GeoDirectory – WP Business Directory Plugin and Classified Listings Directory224,4453,94310k+Output is not escaped
#49Groundhogg — CRM, Newsletters, and Marketing Automation221029012k+Non-prefixed global variable
#50Imagify Image Optimization: Optimize Images | Compress & Convert to WebP/AVIF224168681m+Non-prefixed global variable