PluginScore

WordPress.DB.PreparedSQLPlaceholders.UnfinishedPrepare

Unfinished Prepare

A SQL query is built in a way that Plugin Check cannot verify as safely prepared.

critical weight

Why It Shows Up

The scan found missing, incorrect, quoted, unsupported, or mismatched SQL placeholders around `$wpdb->prepare()` usage.

Why It Matters

Broken preparation can leave dynamic SQL values unsafe or make queries behave differently than intended.

How to Fix

  • Keep placeholders in the SQL string and pass dynamic values as separate arguments.
  • Use the placeholder that matches the value type.
  • Do not quote placeholders manually, and use allowlists for identifiers or SQL fragments.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#301Quick Featured Images3243632350k+Non-prefixed global variable
#302Restrict Usernames Emails Characters323273671k+Output is not escaped
#303UiCore Blocks – Free WordPress Gutenberg Blocks3259387500Non-prefixed global variable
#304Management App for WooCommerce – Order notifications, Order management, Lead management, Uptime Monitoring32196160900Text Domain Mismatch
#305MaxiBlocks Builder | 17,000+ Design Assets, Patterns, Icons & Starter Sites332503800Non-prefixed function
#306Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More332932151k+Text Domain Mismatch
#307Spin Wheel – Interactive spinning wheel that offers coupons33680313500Unsafe printing function
#308Simple Sticky Add To Cart For WooCommerce3340170900Text Domain Mismatch
#309FV Gravatar Cache345042700Output is not escaped
#310Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin34364593k+Input is not sanitized
#311Child Theme Creator by Orbisius34863910k+Output is not escaped
#312PW WooCommerce Bulk Edit3421914920k+Unsafe printing function
#313Software License Manager3469289900Nonce verification recommended
#314WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters3421945360k+wp function not compatible with requires wp
#315Zero Spam for WordPress347939320k+Non-prefixed global variable
#316AfterSalesPro Plugin3524111400Nonce verification recommended
#317SOOZ – AI for SEO – Bulk Generate Focus Keyphrases, Metadata, Alt Text (SEO Autopilot)35443942k+Nonce verification recommended
#318Akismet Anti-spam: Spam Protection3533996m+Non-prefixed global variable
#319Automatic Internal Links for SEO by Pagup35342151k+error log error log
#320BotWriter – AI Writer & SEO Content Generator35165033k+Direct Query
#321CF7 Views – Complete Entry Management for Contact Form 7351721811k+Output is not escaped
#322CompressX — AVIF & WebP Converter, Media Replacement352642340k+Missing nonce verification
#323Core Framework35706210k+Text Domain Mismatch
#324DesignSetGo35203134k+Non-prefixed global variable
#325Easy Social Icons3518215820k+Output is not escaped
#326Export Featured Images35176671k+Output is not escaped
#327HivePress – Business Directory, Listings & Classified Ads Plugin353818010k+Direct Query
#328Kirki – Freeform Page Builder, Website Builder & Customizer351773500k+Nonce verification recommended
#329Recurio – Ultimate Subscription for WooCommerce35343041k+Direct Query
#330Related Posts for WordPress3520718010k+Output is not escaped
#331RTMKit35537850k+Non-prefixed global variable
#332Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant3583762k+Output is not escaped
#333W4 Post List35501383k+Non-prefixed global variable
#334Access Areas for WordPress351795400Direct Query
#335Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder36332110k+Nonce verification recommended
#336Carousel Horizontal Posts Content Slider36271592k+Text Domain Mismatch
#337Desktop Mode3615792k+Direct Query
#338WP CTA – Call Now Button, Sticky Button & Call to Action Builder3614332k+Non-prefixed global variable
#339Enhanced Media Library3636111760k+Unsafe printing function
#340g-FFL Cockpit3617220500Direct Query
#341GetPaid > Wallet36149174700Text Domain Mismatch
#342HTML Forms – Simple WordPress Forms Plugin3623116610k+Output is not escaped
#343HTTP Requests Manager3698901k+Output is not escaped
#344News Manager3613457600Output is not escaped
#345Post Views Stats Counter36142241700Non-prefixed global variable
#346افزونه رسمی ترب36428620k+Exception output is not escaped
#347Better Find and Replace – AI-Powered Suggestions366712940k+Missing direct file access protection
#348SMTP for SendGrid – YaySMTP3627961k+Non-prefixed global variable
#349Bulk Product Editor plugin allows you to create and edit your WooCommerce products and categories with Google Sheets.3650105400Direct Query
#350Zoho ZeptoMail36321105k+Request data is not unslashed