PluginScore

WordPress.DB.PreparedSQLPlaceholders.UnfinishedPrepare

Unfinished Prepare

A SQL query is built in a way that Plugin Check cannot verify as safely prepared.

critical weight

Why It Shows Up

The scan found missing, incorrect, quoted, unsupported, or mismatched SQL placeholders around `$wpdb->prepare()` usage.

Why It Matters

Broken preparation can leave dynamic SQL values unsafe or make queries behave differently than intended.

How to Fix

  • Keep placeholders in the SQL string and pass dynamic values as separate arguments.
  • Use the placeholder that matches the value type.
  • Do not quote placeholders manually, and use allowlists for identifiers or SQL fragments.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#51PagBank / PagSeguro Connect para WooCommerce225047434k+Non-prefixed global variable
#52PDF Builder for WPForms22321266900SQL query is not prepared
#53Request a Quote Form Plugin – Price Quote Request Management Made Easy222411,1091k+Non-prefixed hook name
#54Sellsy22586490400Non Singular String Literal Domain
#55NextScripts: Social Networks Auto-Poster222,4081,13330k+Output is not escaped
#56Swift Performance Lite222,3461,3257k+Text Domain Mismatch
#57Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin225302,33440k+Direct Query
#58Unlimited Elements Blocks Library227081,822400Non-prefixed global variable
#59Welcart e-Commerce2210,37710,89610k+Text Domain Mismatch
#60UserFeedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds22444243200k+Text Domain Mismatch
#61WCFM Marketplace – Multivendor Marketplace for WooCommerce221,9371,96910k+Non-prefixed global variable
#62WooCommerce221,3596,1717m+Non-prefixed global variable
#63Advanced AJAX Product Filters222,6831,20550k+Text Domain Mismatch
#64WP Fusion Lite – Marketing Automation and CRM Integration for WordPress222766835k+Nonce verification recommended
#65WP Umbrella: Update Backup Restore & Monitoring2291891670k+Exception output is not escaped
#66User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration222871,43220k+Non-prefixed global variable
#67YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports2265443510k+Exception output is not escaped
#68Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce231,1851,0271k+Text Domain Mismatch
#69Kadence Security – Password, Two Factor Authentication, and Brute Force Protection231,053967700k+Missing Translators Comment
#70Business Directory Plugin – Easy Listing Directories for WordPress236111,05810k+Non-prefixed global variable
#71Geo Controller232035441k+Non-prefixed global variable
#72Classified Listing – AI-Powered Classified ads & Business Directory231552,0749k+Non-prefixed global variable
#73Content Egg – Affiliate Product Importer & Price Comparison231,2311,25710k+Non-prefixed global variable
#74Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe239,31026,6421k+Non-prefixed global variable
#75Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy2317082140k+Non-prefixed global variable
#76Double Opt-In for Contact Form 7 & Avada – Secure, GDPR-Compliant Email Verification236756431k+Unsafe printing function
#77Easy Digital Downloads – eCommerce Payments and Subscriptions made easy233,72310,28340k+Non-prefixed namespace
#78ElementsReady Addons for Elementor232316663k+Non-prefixed global variable
#79Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light23386999500Non-prefixed global variable
#80Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder234,7461,27930k+Non Singular String Literal Domain
#81FV Flowplayer Video Player231,3111,45420k+Output is not escaped
#82GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress233,6622,97110k+Output is not escaped
#83Groundhogg — CRM, Newsletters, and Marketing Automation231369112k+Non-prefixed global variable
#84Interactive Content – H5P2356538040k+Non Singular String Literal Domain
#85Payment forms, Buy now buttons, and Invoicing System | GetPaid233871,2585k+Non-prefixed global variable
#86Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress2391693300k+Non-prefixed namespace
#87King Addons for Elementor – 80+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce, Mega Menu, Popup Builder231,8373,87810k+Non-prefixed global variable
#88Masteriyo LMS – LMS Course Builder, Quizzes & Certificates231922,1235k+Non-prefixed global variable
#89Like Button Rating ♥ LikeBtn231,2316174k+Unsafe printing function
#90Link Whisper Free233,8825,30330k+Text Domain Mismatch
#91Restaurant Menu and Food Ordering233858532k+Non-prefixed global variable
#92MStore API – Create Native Android & iOS Apps On The Cloud236187643k+SQL query is not prepared
#93Next Active Directory Integration236832842k+Exception output is not escaped
#94Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery232,119986400k+Text Domain Mismatch
#95Patchstack – WordPress & Plugins Security2310748940k+Missing nonce verification
#96Photo Gallery by 10Web – Mobile-Friendly Image Gallery234,1591,553100k+Output is not escaped
#97Post to Google My Business (Google Business Profile)238451,45210k+Non-prefixed global variable
#98Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More23142681100k+Non-prefixed global variable
#99Revive.so – Bulk Rewrite and Republish Blog Posts233322281k+Text Domain Mismatch
#100The Events Calendar233,5113,851700k+Text Domain Mismatch