PluginScore

WordPress.DB.PreparedSQLPlaceholders.UnfinishedPrepare

Unfinished Prepare

A SQL query is built in a way that Plugin Check cannot verify as safely prepared.

critical weight

Why It Shows Up

The scan found missing, incorrect, quoted, unsupported, or mismatched SQL placeholders around `$wpdb->prepare()` usage.

Why It Matters

Broken preparation can leave dynamic SQL values unsafe or make queries behave differently than intended.

How to Fix

  • Keep placeholders in the SQL string and pass dynamic values as separate arguments.
  • Use the placeholder that matches the value type.
  • Do not quote placeholders manually, and use allowlists for identifiers or SQL fragments.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#201FunnelKit – Funnel Builder for WooCommerce Checkout253,1642,62430k+Text Domain Mismatch
#202GeekyBot — AI Copilot, Chatbot, WooCommerce Lead Gen & Zero-Prompt Content25878636k+Non-prefixed global variable
#203Sitemap by BestWebSoft – WordPress XML Site Map Page Generator Plugin2560820720k+Text Domain Mismatch
#204Logo Slider – Logo Showcase, Logo Carousel, Logo Gallery and Client Logo Presentation2578931330k+Text Domain Mismatch
#205Team Members – A WordPress Team Plugin with Gallery, Grid, Carousel, Slider, Table, List, and More251,7862,2202k+Non-prefixed global variable
#206Solid Testimonials – Testimonial Slider, Video Testimonials & Customer Reviews256451,5851k+Non-prefixed global variable
#207HT Contact Form – Drag & Drop Form Builder for WordPress2516059410k+Non-prefixed global variable
#208Independent Analytics – WordPress Analytics Plugin251,1482,293100k+Non-prefixed global variable
#209Smash Balloon Social Photo Feed – Easy Social Feeds Plugin254491,3001m+Interpolated SQL is not prepared
#210Bulk Page Generator – LPagery256701,9263k+Non-prefixed global variable
#211LWS Optimize – All-in-One Speed Booster & Cache Tools2543076420k+Non-prefixed global variable
#212Media Cleaner: Clean your WordPress!2515139190k+Direct Query
#213Create251,6377646k+Text Domain Mismatch
#214NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar2525740040k+Non-prefixed hook name
#215Notifications for Forms & WordPress Actions253092821k+Text Domain Mismatch
#216phpinfo() WP — Site Health, PHP Compatibility & Server Audit252767043k+Non-prefixed global variable
#217Premmerce Product Search for WooCommerce255961,350900Non-prefixed global variable
#218Premmerce Wholesale Pricing for WooCommerce256351,377400Non-prefixed global variable
#219Quiz Maker by AYS255053,02320k+Non-prefixed global variable
#220The School Management – Education & Learning ERP2512,858800Non-prefixed global variable
#221SEO Booster253931,4681k+Non-prefixed global variable
#222ShopMagic – email automation2522814510k+Exception output is not escaped
#223Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin2596073860k+Text Domain Mismatch
#224Smart Image Resize for WooCommerce255824047k+Text Domain Mismatch
#225Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management2536692310k+SQL query is not prepared
#226Stylish Cost Calculator – Quote Generator, Lead Gen & Price Estimator256481,0211k+Output is not escaped
#227SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent254321,35710k+Direct Query
#228Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin251192,7042k+Non-prefixed global variable
#229TrackShip for WooCommerce254219576k+Non-prefixed global variable
#230TranslatePress – Translate Multilingual sites with AI Translation254551,545400k+Non-prefixed function
#231TrueBooker – Appointment Booking and Scheduler System255292,746600Non-prefixed global variable
#232PDF Builder for WooCommerce. Create invoices,packing slips and more253725032k+Non-prefixed global variable
#233Wordfence Login Security2524841870k+Output is not escaped
#234WP Go Maps – Google Map, OpenStreetMap, Leaflet Map254,9961,008300k+Unsafe printing function
#235WP Photo Album Plus2531,79910k+Direct Query
#236SlimStat Analytics251,17787070k+Exception output is not escaped
#237WP TripAdvisor Review Slider259582,0588k+Non-prefixed global variable
#238WPvivid — Backup, Migration & Staging258991,461900k+Non-prefixed namespace
#239Video Gallery – YouTube Gallery, Playlist & Video Grid252751,0662k+Non-prefixed hook name
#240CP Multi View Events Calendar26864391k+Non-prefixed global variable
#241WP Frontend Admin – Display WP Admin Pages in the Frontend26347337400Non Singular String Literal Domain
#242Event Monster – Event Manager, Ticket Booking & Registration26781781700Non-prefixed global variable
#243Image SEO – AI-Driven Image SEO Optimizer263503271k+Text Domain Mismatch
#244Kirki – Freeform Page Builder, Website Builder & Customizer26192799500k+Nonce verification recommended
#245OOPSpam Anti-Spam: Spam Protection for WordPress Forms & Comments (No CAPTCHA)262725766k+Request data is not unslashed
#246Contact Form Generator : Creative form builder for WordPress271,0761,510800Output is not escaped
#247Echo Knowledge Base – Documentation, FAQs, Chat & Smart Search2728975110k+Output is not escaped
#248CM Tooltip Glossary276111887k+Output is not escaped
#249Events Calendar for GeoDirectory271,2294622k+Text Domain Mismatch
#250My Private Site – Make Your Whole Site Private, Force Login & Block Registration Spam2771332120k+Text Domain Mismatch