PluginScore

WordPress.DB.PreparedSQLPlaceholders.UnfinishedPrepare

Unfinished Prepare

A SQL query is built in a way that Plugin Check cannot verify as safely prepared.

critical weight

Why It Shows Up

The scan found missing, incorrect, quoted, unsupported, or mismatched SQL placeholders around `$wpdb->prepare()` usage.

Why It Matters

Broken preparation can leave dynamic SQL values unsafe or make queries behave differently than intended.

How to Fix

  • Keep placeholders in the SQL string and pass dynamic values as separate arguments.
  • Use the placeholder that matches the value type.
  • Do not quote placeholders manually, and use allowlists for identifiers or SQL fragments.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#151MailerPress – Newsletter, email marketing & AI automation248053,9311k+Direct Query
#152Timetable and Event Schedule by MotoPress2445623230k+Output is not escaped
#153MxChat – AI Chatbot & Content Generation for WordPress243,2201,3992k+Text Domain Mismatch
#154Simple Newsletter Plugin – Noptin246659110k+Non-prefixed global variable
#155NEX-Forms – Ultimate Forms Plugin for WordPress242,0081,1956k+Text Domain Mismatch
#156Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors2436982020k+Nonce verification recommended
#157Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker244072,58740k+Non-prefixed hook name
#158Registrations for the Events Calendar – Event Registration Plugin244059437k+Non-prefixed global variable
#159Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More24141685100k+Non-prefixed global variable
#160Security Plugin, Firewall & Malware Scanner with Auto Removal241,18877030k+Output is not escaped
#161SEO Engine – Smart SEO with AI, Schema & Redirection for WordPress242393041k+Direct Query
#162SEOKEY – Powerful SEO plugin with Expert Insights and SEO Audit246059281k+Non-prefixed global variable
#163Sokol: Smart WooCommerce Search245991,5516k+Non-prefixed global variable
#164GEO Plugin by Squirrly SEO241,19522430k+Missing Translators Comment
#165StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More24149482600Non-prefixed global variable
#166Stripe Payment Forms by WP Simple Pay – Accept Credit Card Payments + Subscriptions with Stripe246346529k+Exception output is not escaped
#167Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers243601,4721k+Nonce verification recommended
#168Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System245898972k+Non-prefixed global variable
#169Tainacan241385921k+Direct Query
#170Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud!24167225400k+Nonce verification recommended
#171TI WooCommerce Wishlist24467546100k+Output is not escaped
#172Tutor LMS – eLearning and online course solution243284,409100k+Non-prefixed global variable
#173Ultimate Product Catalog245545255k+Unsafe printing function
#174Unlimited Elements For Elementor247102,093300k+Non-prefixed global variable
#175User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder246643,32150k+Non-prefixed global variable
#176Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels241,6151,38170k+Text Domain Mismatch
#177Bulk Edit Products for WooCommerce – WP Sheet Editor2494193610k+Text Domain Mismatch
#178Coupon Affiliates – Affiliate Plugin for WooCommerce241,0223,0745k+Non-prefixed global variable
#179Bulk Edit Coupons for WooCommerce – WP Sheet Editor241,006950500Text Domain Mismatch
#180Payment Gateway for PayPal on WooCommerce2415356110k+Nonce verification recommended
#181WordLift – AI powered SEO – Schema24278949400Non-prefixed hook name
#182Yoast SEO – Advanced SEO with real-time guidance and built-in AI2415938610m+Non-prefixed global variable
#183Auto Affiliate Links243754073k+Output is not escaped
#184WP Helper Premium243,9081,5151k+Text Domain Mismatch
#185WP-Members Membership Plugin2466938250k+Output is not escaped
#186WP Recipe Maker2449294150k+Non-prefixed global variable
#187Bulk Edit Posts and Products in Spreadsheet249189128k+Text Domain Mismatch
#188WSMS (formerly WP SMS) – SMS & MMS Notifications with OTP and 2FA for WooCommerce24911,7257k+Non-prefixed hook name
#189WP Travel Engine – Tour Booking Plugin – Tour Operator Software242,0105,68820k+Non-prefixed global variable
#190YMC Filter24121,7294k+Non-prefixed global variable
#191Affiliates256891,4832k+Output is not escaped
#192Booking Package251,7033,97710k+Missing nonce verification
#193Breeze Cache25218800400k+Non-prefixed global variable
#194SilentShield – Captcha & Anti-Spam for WordPress (CF7, WPForms, Elementor, WooCommerce)2523521410k+Database parameter is not escaped
#195Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode25991,040700k+Non-prefixed global variable
#196Disable Comments & Delete All Comments255031859k+Output is not escaped
#197Event Genius – Event Management, Events Calendar, Registration, and RSVP251811,579500Non-prefixed global variable
#198Events Made Easy255066,3171k+Non-prefixed function
#199FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler253234997k+Non-prefixed global variable
#200AnWP Football Leagues253,5981,955900Text Domain Mismatch