PluginScore

WordPress.DB.PreparedSQLPlaceholders.UnnecessaryPrepare

Unnecessary Prepare

A SQL query is built in a way that Plugin Check cannot verify as safely prepared.

critical weight

Why It Shows Up

The scan found missing, incorrect, quoted, unsupported, or mismatched SQL placeholders around `$wpdb->prepare()` usage.

Why It Matters

Broken preparation can leave dynamic SQL values unsafe or make queries behave differently than intended.

How to Fix

  • Keep placeholders in the SQL string and pass dynamic values as separate arguments.
  • Use the placeholder that matches the value type.
  • Do not quote placeholders manually, and use allowlists for identifiers or SQL fragments.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#1Shopping Cart & eCommerce Store177,49217,5543k+Non-prefixed global variable
#2Event Organiser201,10454420k+Text Domain Mismatch
#3WP Compress – Instant Performance & Speed Optimization204,2923,69110k+Non Singular String Literal Domain
#4Leyka212573,4462k+Request data is not unslashed
#5WP-Lister Lite for eBay216,7015,1402k+Output is not escaped
#6WPBot – AI ChatBot for Live Support, Lead Generation, WordPress Automation, AI Services221721,7255k+Non-prefixed global variable
#7Directorist: AI-Powered Business Directory, Listings & Classified Ads224862,32720k+Non-prefixed global variable
#8Employee Spotlight – Team Member Showcase & Meet the Team Plugin22247689300Non-prefixed hook name
#9ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce228305,9785k+Direct Query
#10Hesabfa Accounting22467718500Text Domain Mismatch
#11myCred Addons – Ultimate myCred Modules To Support WordPress Gamification and Loyalty Rewards222,3441,320400Output is not escaped
#12Easy Appointment Booking & Scheduling System – Webba Booking Calendar221,6663,4712k+Non-prefixed global variable
#13Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress235591,52550k+Non-prefixed hook name
#14Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light23386999400Non-prefixed global variable
#15GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI233,5232,49710k+Output is not escaped
#16The Innovative Form Builder – IvyForms238143901k+Exception output is not escaped
#17License Manager for WooCommerce231318056k+Nonce verification recommended
#18Request a Quote – Quote Forms for Any WordPress Site232401,099900Non-prefixed hook name
#19teachPress237441,5872k+SQL query is not prepared
#20Customer Support Ticket System & Helpdesk231,7231,454400Text Domain Mismatch
#21WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell236,2722,7795k+Text Domain Mismatch
#22Advanced Form Integration — Connect Forms to 300+ Apps245,7434,5749k+wp function not compatible with requires wp
#23Easy Invoice – Invoice Generator, PDF Quotes & Payments241172,192500Non-prefixed global variable
#24Etsy Integration For WooCommerce241,2464,643900Non-prefixed global variable
#25Kirki – Freeform Page Builder, Website Builder & Customizer24224817500k+Exception output is not escaped
#26Bulk Page Generator – LPagery248002,3213k+Non-prefixed global variable
#27Post Status Notifier Lite24984451700Missing direct file access protection
#28WP-Lister Lite for Amazon243,0604,178800Output is not escaped
#29WSMS (formerly WP SMS) – SMS & MMS Notifications with OTP and 2FA for WooCommerce24901,7357k+Non-prefixed hook name
#30WP Travel Engine – Tour Booking Plugin – Tour Operator Software242,0895,83920k+Non-prefixed global variable
#31WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode252511,9339k+Non-prefixed global variable
#32Taskbuilder – Project Management & Task Management Tool With Kanban Board251364,570700Non-prefixed global variable
#33Video Gallery – YouTube Gallery, Playlist & Video Grid25881,0152k+Non-prefixed hook name
#34Video Gallery – Vimeo and YouTube Gallery265617946k+Non-prefixed global variable
#35Contact Form Generator : Creative form builder for WordPress271,0751,511700Output is not escaped
#36wp-mpdf271233821k+Non-prefixed global variable
#37Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker28691,0015k+Interpolated SQL is not prepared
#38Easy HTTPS Redirection (SSL)29266152100k+Unsafe printing function
#39Post Grid Gutenberg Blocks – PostX2911840230k+Non-prefixed global variable
#40Zoho CRM Lead Magnet301011,0253k+Request data is not unslashed
#41Slider Carousel – Image Slider312241,2333k+Request data is not unslashed
#42WPS Cleaner3142949110k+Output is not escaped
#43Dynamic Pricing With Discount Rules for WooCommerce32130785k+Output is not escaped
#44Blue Captcha32271,834400Non-prefixed global variable
#45WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters3221744360k+wp function not compatible with requires wp
#46Melhor Envio332527710k+Nonce verification recommended
#47CM Search And Replace – Optimize content edits with a powerful search and replace tool342861112k+Output is not escaped
#48Management App for WooCommerce – Order notifications, Order management, Lead management, Uptime Monitoring3547102800Non-prefixed global variable
#49CM Header and Footer – Add custom scripts and styles to your header and footer with ease36230198900Output is not escaped
#50CP Blocks3646381k+wp function not compatible with requires wp