PluginScore

WordPress.DB.PreparedSQLPlaceholders.UnfinishedPrepare

Unfinished Prepare

A SQL query is built in a way that Plugin Check cannot verify as safely prepared.

critical weight

Why It Shows Up

The scan found missing, incorrect, quoted, unsupported, or mismatched SQL placeholders around `$wpdb->prepare()` usage.

Why It Matters

Broken preparation can leave dynamic SQL values unsafe or make queries behave differently than intended.

How to Fix

  • Keep placeholders in the SQL string and pass dynamic values as separate arguments.
  • Use the placeholder that matches the value type.
  • Do not quote placeholders manually, and use allowlists for identifiers or SQL fragments.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#1AnyComment174454495k+Output is not escaped
#2RestroPress – Online Food Ordering System175243,1551k+Non-prefixed global variable
#3wpForo Forum174,0482,92220k+Unsafe printing function
#4Shopping Cart & eCommerce Store185,37317,4663k+Non-prefixed global variable
#5WPPizza – A Restaurant Plugin184,6892,7031k+Text Domain Mismatch
#6Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution191,218901100k+Exception output is not escaped
#7Membership Plugin – Kadence Memberships195,0822,9829k+Text Domain Mismatch
#8SendPress Newsletters192,2931,4221k+Output is not escaped
#9Brizy – Page Builder2058672670k+Output is not escaped
#10Event Espresso – Event Registration & Ticketing Sales2012,6982,135600Text Domain Mismatch
#11GiveWP – Donation Plugin and Fundraising Platform203,4103,554100k+Output is not escaped
#12Microthemer Lite – Visual Editor to Customize CSS201,0041,69910k+Non-prefixed global variable
#13Premium Packages – Sell Digital Products Securely202,0322,1902k+Non-prefixed global variable
#14School Management System – WPSchoolPress203535,2781k+Non-prefixed global variable
#15Store Locator WordPress212,4941,62810k+Text Domain Mismatch
#16Forumax – AI Powered Advanced Community Forum Plugin214,9364,353600Text Domain Mismatch
#17bbPress219293,672100k+Non-prefixed function
#18Kadence Security – Password, Two Factor Authentication, and Brute Force Protection211,060957700k+Missing Translators Comment
#19Pinpoint Booking System – Version 2216343283k+Missing direct file access protection
#20Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots211,6212,03310k+Direct Query
#21CartFlows – Funnel Builder & Checkout Plugin for WooCommerce21462656200k+Text Domain Mismatch
#22Free Downloads WooCommerce214303594k+Output is not escaped
#23Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More21522,063300k+Non-prefixed global variable
#24Frontend Dashboard21384945500Non-prefixed function
#25Imagify Image Optimization: Optimize Images | Compress & Convert to WebP/AVIF214288621m+Non-prefixed global variable
#26Mooberry Book Manager211,0403991k+Text Domain Mismatch
#27MotoPress Hotel Booking213,0671,03710k+Text Domain Mismatch
#28Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred211,4783,33710k+Non-prefixed global variable
#29Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction211,9535,29710k+Non-prefixed hook name
#30PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI)21485813300Missing direct file access protection
#31Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin211,0642,97840k+Direct Query
#32Wise Chat214705065k+Output is not escaped
#33WooCommerce211,3436,2127m+Non-prefixed global variable
#34Wordfence Security – Firewall, Malware Scan, and Login Security211,5922,9735m+Output is not escaped
#35wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin211,8121,43270k+Output is not escaped
#36WP Extended – The Ultimate WordPress Toolkit211,253398600Non Singular String Literal Domain
#37WPScan – WordPress Security Scanner215272658k+Text Domain Mismatch
#38Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer222,8541,26950k+Text Domain Mismatch
#39RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login223,6525,1348k+Non-prefixed global variable
#40Directorist: AI-Powered Business Directory, Listings & Classified Ads225602,20220k+Non-prefixed global variable
#41E2Pdf – Export Pdf Tool for WordPress221,08184710k+Unsafe printing function
#42Events Maker by dFactory225888191k+Output is not escaped
#43Events Manager – Calendar, Bookings, Tickets, and more!224,7165,69070k+Output is not escaped
#44FACTO – Facturación Electrónica22244423400Request data is not unslashed
#45Finale Lite – Sales Countdown Timer & Discount for WooCommerce221,0314514k+Output is not escaped
#46GeoDirectory – WP Business Directory Plugin and Classified Listings Directory224,4653,97610k+Output is not escaped
#47The Innovative Form Builder – IvyForms22750309800Exception output is not escaped
#48LearnPress – WordPress LMS Plugin for Create and Sell Online Courses222,4333,59470k+Non-prefixed global variable
#49Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization221,3062,8188k+Output is not escaped
#50Modula Image Gallery – Photo Grid & Video Gallery22474437100k+Text Domain Mismatch