PluginScore

WordPress.DB.PreparedSQLPlaceholders.UnfinishedPrepare

Unfinished Prepare

A SQL query is built in a way that Plugin Check cannot verify as safely prepared.

critical weight

Why It Shows Up

The scan found missing, incorrect, quoted, unsupported, or mismatched SQL placeholders around `$wpdb->prepare()` usage.

Why It Matters

Broken preparation can leave dynamic SQL values unsafe or make queries behave differently than intended.

How to Fix

  • Keep placeholders in the SQL string and pass dynamic values as separate arguments.
  • Use the placeholder that matches the value type.
  • Do not quote placeholders manually, and use allowlists for identifiers or SQL fragments.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#251Events Calendar for GeoDirectory271,2624622k+Text Domain Mismatch
#252My Private Site – Make Your Whole Site Private, Force Login & Block Registration Spam2771332120k+Text Domain Mismatch
#253Magical Shop Builder – WooCommerce Template Builder for Elementor | Shop, Cart, Checkout & Product Page Builder27764593k+Non-prefixed namespace
#254Pie Register – User Registration, Profiles & Content Restriction271,7791k+Non-prefixed global variable
#255Social Web Suite – Social Media Auto Post, Social Media Auto Publish2774164500Non-prefixed global variable
#256Ultimate Watermark – Image Watermark, Image Protection & Bulk Watermarking271643031k+Nonce verification recommended
#257Watu Quiz271,0891,0143k+Output is not escaped
#258WP Activity Log2796230300k+Nonce verification recommended
#259Maspik – Ultimate Spam Protection2821286230k+Missing nonce verification
#260Database Cleaner2813729710k+Direct Query
#261Discount Rules and Dynamic Pricing for WooCommerce2818233410k+Output is not escaped
#262FAPI Member28279153500Exception output is not escaped
#263Fluent Support – Helpdesk & Customer Support Ticket System285027110k+Direct Query
#264Geo Mashup287752321k+Text Domain Mismatch
#265Media Hygiene: Remove or Delete Unused Images and More!286543095k+Non Singular String Literal Domain
#266ووکامرس فارسی2815721590k+Output is not escaped
#26710WebSocial2858418510k+Unsafe printing function
#268WP ADA Compliance Check Basic287851773k+Text Domain Mismatch
#269WxSync-标准云微信公众号文章免费采集-任意公众号自动采集付费购买2857138500Request data is not unslashed
#270AL Pack29138162k+Non-prefixed global variable
#271CloudSecure WP Security2974350100k+Request data is not unslashed
#272Easy HTTPS Redirection (SSL)29266152100k+Unsafe printing function
#273Meow Gallery2911318210k+Direct Query
#274Post Views Counter29179398200k+Non-prefixed hook name
#275Relevant – Related, Featured, Latest, and Popular Posts by BestWebSoft29487262800Text Domain Mismatch
#276Security Ninja – WordPress Security & Firewall291493477k+Direct Query
#277Social Engine2913390600Exception output is not escaped
#278SureForms – Drag & Drop Contact Form & Form Builder, Payment Form, Survey, Quiz & Calculator29336198500k+Text Domain Mismatch
#279weMail – Email Marketing, Newsletter Builder & Email Automations for WooCommerce292766810k+Missing direct file access protection
#280Xagio SEO – AI Powered SEO2921,27310k+Direct Query
#281Advanced Database Cleaner – Optimize & Clean Database to Speed Up Site Performance30164439100k+Interpolated SQL is not prepared
#282AI Product Tools – Bulk Product Content Generator & AI Toolkit for WooCommerce30508562400SQL query is not prepared
#283AutoWP – AI Content Writer & Rewriter305483701k+Text Domain Mismatch
#284Sliding Cart for WooCommerce by FunnelKit – Skip Cart & Reach WooCommerce Checkout Faster3030643430k+Non-prefixed global variable
#285Custom Search by BestWebSoft – WordPress Custom Search Plugin30454228900Text Domain Mismatch
#286Edwiser Bridge – WordPress Moodle Integration3046694k+Non-prefixed hook name
#287Popup Builder – Create highly converting, mobile friendly marketing popups.3026722200k+Non-prefixed global variable
#288Sync Master Sheet – Product Sync with Google Sheet for WooCommerce30136300400Non-prefixed global variable
#289QA Assistants – Driven by data3048672k+Non-prefixed global variable
#290SMTP for Amazon SES – YaySMTP301971223k+Exception output is not escaped
#291Waitlist Woocommerce ( Back in stock notifier )302723114k+Output is not escaped
#292WCPOS – Point of Sale (POS) plugin for WooCommerce30772285k+Nonce verification recommended
#293WP Inventory Manager308562331k+Output is not escaped
#294YayPricing – WooCommerce Dynamic Pricing & Discounts301741863k+Non-prefixed global variable
#295SEO合集(支持百度/Google/Bing/头条推送)31131,407800Direct Query
#296GS Pinterest Portfolio – Pins Grid, Masonry, User Profile, Popup & Board Widgets314021561k+Text Domain Mismatch
#297ImgSEO – AI Image Alt Text Generator & Image SEO Tools311677400Direct Query
#298Raffle Play Woocommerce31151199800Output is not escaped
#299Staatic – Static Site Generator for WordPress314201952k+SQL query is not prepared
#300Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker31639356k+Interpolated SQL is not prepared