PluginScore

WordPress.DB.PreparedSQLPlaceholders.UnfinishedPrepare

Unfinished Prepare

A SQL query is built in a way that Plugin Check cannot verify as safely prepared.

critical weight

Why It Shows Up

The scan found missing, incorrect, quoted, unsupported, or mismatched SQL placeholders around `$wpdb->prepare()` usage.

Why It Matters

Broken preparation can leave dynamic SQL values unsafe or make queries behave differently than intended.

How to Fix

  • Keep placeholders in the SQL string and pass dynamic values as separate arguments.
  • Use the placeholder that matches the value type.
  • Do not quote placeholders manually, and use allowlists for identifiers or SQL fragments.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#101The Events Calendar233,5113,851700k+Text Domain Mismatch
#102Tutor LMS – eLearning and online course solution233953,402100k+Non-prefixed global variable
#103UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP236952,43420k+Non-prefixed hook name
#104Advanced Booking & Appointment System – Webba Booking Calendar231,6153,3002k+Non-prefixed global variable
#105ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin237,4232,18190k+Text Domain Mismatch
#106Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions231,1231,8609k+Output is not escaped
#107Lead Form Data Collection to CRM232111,698400Non-prefixed global variable
#108WP-Lister Lite for Amazon233,0614,177900Output is not escaped
#109FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce239402,18020k+SQL query is not prepared
#110Customer Support Ticket System & Helpdesk231,7191,464400Text Domain Mismatch
#111Photo Engine (Media Organizer & Lightroom)232526502k+Direct Query
#112Yatra – Travel Booking & Tour Operator Software232,2113,994600Non-prefixed global variable
#113404 Solution244861,33810k+Non-prefixed class
#114Academy LMS – WordPress LMS Plugin for Complete eLearning Solution241627872k+Non-prefixed global variable
#115AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress241,7051,3937k+Text Domain Mismatch
#116Awesome Support – WordPress HelpDesk & Support Plugin242251,2396k+Non-prefixed global variable
#117Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale)241,8371,0631k+Text Domain Mismatch
#118Product Feed Manager For WooCommerce – Sell on 200+ Online Marketplaces242,2483,33810k+slow db query meta key
#119Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More243429306k+Non-prefixed global variable
#120BrikPanel — WooCommerce Dashboard, Sales Report, Google Sheets Sync, Inventory Management & Bulk Editor243,9451,253400Text Domain Mismatch
#121Bulk Edit Categories and Tags – Create Thousands Quickly on the Editor241,0259844k+Text Domain Mismatch
#122Bulk Edit and Create User Profiles – WP Sheet Editor249799691k+Text Domain Mismatch
#123Kognetiks Chatbot for WordPress246511,486600Non-prefixed global variable
#124Smart Online Order for Clover241,7461,2461k+Text Domain Mismatch
#125RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress248283,665500Request data is not unslashed
#126WPBot – ChatBot Conversational Forms241,2541,2262k+Text Domain Mismatch
#127Customer Reviews for WooCommerce242,2062,44380k+Output is not escaped
#128Easy Invoice – Invoice Generator, PDF Quotes & Payments241,3662,006500Non-prefixed global variable
#129eCommerce Product Catalog Plugin for WordPress246213,1777k+Non-prefixed function
#130Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress246521,49560k+Non-prefixed hook name
#131EmbedPress – PDF Embedder, Embed PDF viewer, YouTube Videos, 3D FlipBook, Social feeds & more246691,550100k+Output is not escaped
#132Conversios: Google Analytics (GA4), Google Ads, Conversion and Analytics Tracking for Multi-Channels241071,46110k+Non-prefixed global variable
#133Event Tickets and Registration243,4114,21790k+Non-prefixed global variable
#134Etsy Integration For WooCommerce241,2464,643900Non-prefixed global variable
#135F12 Profiler24282451500Direct Query
#136Fast Velocity Minify2428225640k+Unsafe printing function
#137Featured Image from URL (FIFU)241,65441870k+Non Singular String Literal Domain
#138FV Player 8243231,3831k+Non-prefixed function
#139Cookie Banner for GDPR / CCPA – WPLP Cookie Consent241,2091,9319k+Non-prefixed global variable
#140GS Behance Portfolio – Display Projects, Gallery & Slider248551,617400Non-prefixed global variable
#141Koko Analytics – Privacy-Friendly WordPress Analytics2416128060k+Short PHP open tag found
#142LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes244141,17610k+Non-prefixed global variable
#143Limit Attempts by BestWebSoft – WordPress Anti-Bot and Security Plugin for Login and Forms245635484k+Text Domain Mismatch
#144Event Booking Manager for WooCommerce249682,1227k+Non-prefixed global variable
#145Mailchimp for WooCommerce24523663200k+Non-prefixed global variable
#146MailerPress – Email Marketing, Newsletter, Email Automation & WooCommerce Emails247723,8531k+Direct Query
#147Timetable and Event Schedule by MotoPress2445623230k+Output is not escaped
#148MxChat – AI Chatbot & Content Generation for WordPress243,1571,3852k+Text Domain Mismatch
#149Simple Newsletter Plugin – Noptin246659110k+Non-prefixed global variable
#150NEX-Forms – Ultimate Forms Plugin for WordPress242,0081,1956k+Text Domain Mismatch