PluginScore

WordPress.DB.PreparedSQLPlaceholders.UnnecessaryPrepare

Unnecessary Prepare

A SQL query is built in a way that Plugin Check cannot verify as safely prepared.

critical weight

Why It Shows Up

The scan found missing, incorrect, quoted, unsupported, or mismatched SQL placeholders around `$wpdb->prepare()` usage.

Why It Matters

Broken preparation can leave dynamic SQL values unsafe or make queries behave differently than intended.

How to Fix

  • Keep placeholders in the SQL string and pass dynamic values as separate arguments.
  • Use the placeholder that matches the value type.
  • Do not quote placeholders manually, and use allowlists for identifiers or SQL fragments.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#1Shopping Cart & eCommerce Store185,37317,4663k+Non-prefixed global variable
#2Event Organiser201,10454420k+Text Domain Mismatch
#3Leyka212573,4462k+Request data is not unslashed
#4WP Compress – Instant Performance & Speed Optimization213,3673,25310k+Non Singular String Literal Domain
#5WP-Lister Lite for eBay216,6965,1282k+Output is not escaped
#6Directorist: AI-Powered Business Directory, Listings & Classified Ads225602,20220k+Non-prefixed global variable
#7Employee Spotlight – Team Member Showcase & Meet the Team Plugin22247689400Non-prefixed hook name
#8Hesabfa Accounting22467718500Text Domain Mismatch
#9The Innovative Form Builder – IvyForms22750309800Exception output is not escaped
#10myCred Addons – Ultimate myCred Modules To Support WordPress Gamification and Loyalty Rewards222,3441,320400Output is not escaped
#11Easy Appointment Booking & Scheduling System – Webba Booking Calendar221,6173,3802k+Non-prefixed global variable
#12WPBot – AI ChatBot for Live Support, Lead Generation, AI Services235141,2215k+Non-prefixed global variable
#13Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress236531,51050k+Non-prefixed hook name
#14ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce238285,9685k+Direct Query
#15Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light23386999400Non-prefixed global variable
#16GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress233,5942,77510k+Output is not escaped
#17License Manager for WooCommerce231318056k+Nonce verification recommended
#18Request a Quote – Quote Forms for Any WordPress Site232401,099900Non-prefixed hook name
#19teachPress237441,5872k+SQL query is not prepared
#20WP-Lister Lite for Amazon233,0614,177800Output is not escaped
#21Customer Support Ticket System & Helpdesk231,7231,454400Text Domain Mismatch
#22WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell236,0042,7615k+Text Domain Mismatch
#23Advanced Form Integration — Connect Forms to 200+ Apps245,7404,56010k+wp function not compatible with requires wp
#24Easy Invoice – Invoice Generator, PDF Quotes & Payments241,3662,013600Non-prefixed global variable
#25Etsy Integration For WooCommerce241,2464,643900Non-prefixed global variable
#26Kirki – Freeform Page Builder, Website Builder & Customizer24222814500k+Exception output is not escaped
#27Post Status Notifier Lite24984451700Missing direct file access protection
#28Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels241,6161,37880k+Text Domain Mismatch
#29WSMS (formerly WP SMS) – SMS & MMS Notifications with OTP and 2FA for WooCommerce24931,7327k+Non-prefixed hook name
#30WP Travel Engine – Tour Booking Plugin – Tour Operator Software242,0305,70420k+Non-prefixed global variable
#31Dynamic Pricing With Discount Rules for WooCommerce251652055k+Non-prefixed global variable
#32WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode251,2501,92910k+Non-prefixed global variable
#33Bulk Page Generator – LPagery256651,9223k+Non-prefixed global variable
#34Taskbuilder – Project Management & Task Management Tool With Kanban Board251284,376800Non-prefixed global variable
#35Video Gallery – YouTube Gallery, Playlist & Video Grid252751,0662k+Non-prefixed hook name
#36Video Gallery – Vimeo and YouTube Gallery265617946k+Non-prefixed global variable
#37Contact Form Generator : Creative form builder for WordPress271,0761,510800Output is not escaped
#38wp-mpdf271233821k+Non-prefixed global variable
#39Easy HTTPS Redirection (SSL)29266152100k+Unsafe printing function
#40Post Grid Gutenberg Blocks – PostX2911840440k+Non-prefixed global variable
#41Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker29699806k+Interpolated SQL is not prepared
#42WPS Cleaner3043049120k+Output is not escaped
#43Zoho CRM Lead Magnet301011,0253k+Request data is not unslashed
#44Slider Carousel – Image Slider312241,2333k+Request data is not unslashed
#45Rich Showcase for Google Reviews33212278100k+Output is not escaped
#46WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters3322245260k+wp function not compatible with requires wp
#47CM Search And Replace – Optimize content edits with a powerful search and replace tool342861112k+Output is not escaped
#48Ni WooCommerce Sales Report35236256500Text Domain Mismatch
#49Management App for WooCommerce – Order notifications, Order management, Lead management, Uptime Monitoring3547102900Non-prefixed global variable
#50CM Header and Footer – Add custom scripts and styles to your header and footer with ease362301981k+Output is not escaped