PluginScore

WordPress.DB.PreparedSQLPlaceholders.UnquotedComplexPlaceholder

Unquoted Complex Placeholder

A SQL query is built in a way that Plugin Check cannot verify as safely prepared.

critical weight

Why It Shows Up

The scan found missing, incorrect, quoted, unsupported, or mismatched SQL placeholders around `$wpdb->prepare()` usage.

Why It Matters

Broken preparation can leave dynamic SQL values unsafe or make queries behave differently than intended.

How to Fix

  • Keep placeholders in the SQL string and pass dynamic values as separate arguments.
  • Use the placeholder that matches the value type.
  • Do not quote placeholders manually, and use allowlists for identifiers or SQL fragments.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#1Razorpay for WooCommerce20975859100k+Non-prefixed function
#2SMS Extension for Contact Form 7217201,387400Non-prefixed global variable
#3MotoPress Hotel Booking213,0671,03710k+Text Domain Mismatch
#4Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred211,4363,34510k+Non-prefixed global variable
#5Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent222265138k+error log error log
#6RapidLoad AI – Optimize Web Vitals Automatically2281840700Nonce verification recommended
#7WooCommerce221,3436,2107m+Non-prefixed global variable
#8RexFeed – Product Feed Manager for WooCommerce – Google Shopping, Facebook, Amazon, ChatGPT & 200+ Channel Feeds232,5023,42110k+slow db query meta key
#9Easy Digital Downloads – eCommerce Payments and Subscriptions made easy233,7028,48640k+Non-prefixed namespace
#10MotoPress Appointment Booking232,3638682k+Text Domain Mismatch
#11WP Webhooks – Automate repetitive tasks by creating powerful automation workflows directly within WordPress234,38088820k+Output is not escaped
#12Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress232,3171,7145k+Output is not escaped
#13Awesome Support – WordPress HelpDesk & Support Plugin242251,2396k+Non-prefixed global variable
#14Contact Form by Supsystic241,7646136k+Non Singular String Literal Domain
#15Fix Alt Text245443461k+Non Singular String Literal Domain
#16Easy Google Maps241,65239620k+Non Singular String Literal Domain
#17Kirki – Freeform Page Builder, Website Builder & Customizer24222816500k+Exception output is not escaped
#18Mang Board WP241,2074,7418k+Non-prefixed global variable
#19Premmerce Product Filter for WooCommerce248171,4862k+Non-prefixed global variable
#20Pricing Table by Supsystic241,22744110k+Non Singular String Literal Domain
#21Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker243812,62640k+Non-prefixed hook name
#22SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery248371,8953k+Non-prefixed global variable
#23Ultimate Maps by Supsystic2493936810k+Non Singular String Literal Domain
#24UserFeedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds24441235200k+Text Domain Mismatch
#25WP Recipe Maker2449895250k+Non-prefixed global variable
#26Cryptocurrency Payment Gateway251,963589400Text Domain Mismatch
#27ELEX WooCommerce Request a Quote253982662k+Request data is not unslashed
#28Events Made Easy255406,5481k+Non-prefixed function
#29Form Vibes – Save Contact Form 7 & Elementor Form Entries to Database257161,50910k+Non-prefixed global variable
#30Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails255,0841,7905k+Text Domain Mismatch
#31Post Snippets – Custom WordPress Code Snippets Customizer258031,65520k+Non-prefixed global variable
#32Product Sync for WooCommerce – API Import, Dropshipping & Inventory Sync25211472300Interpolated SQL is not prepared
#33SEO Repair Kit – Spam Monitor, Meta Manager, Schema Manager, SEO Content Monitoring, GSC Integration, Keyword & Rank Tracking252099542k+Missing nonce verification
#34ShopMagic – email automation for WordPress2522814810k+Exception output is not escaped
#35STAGGS – Product Configurator Toolkit256262,180400Non-prefixed global variable
#36Sugar Calendar – Events Calendar, Event Tickets, and Events Management Platform2533178910k+Nonce verification recommended
#37TrackShip for WooCommerce254059546k+Non-prefixed global variable
#38TranslatePress – Translate Multilingual sites with AI Translation255691,680400k+Non-prefixed hook name
#39Advanced Shipment Tracking for WooCommerce2550570770k+Non-prefixed global variable
#40WP Admin Audit251,0587811k+error log print r
#41ELEX WooCommerce Google Shopping (Google Product Feed)262262421k+Text Domain Mismatch
#42Speed Booster Pack ⚡ PageSpeed Optimization Suite271081879k+Missing Translators Comment
#43WPDoctor Malware Scanner & Vulnerability Checker & IP blocker with Hack monitor Lite31133438600Non-prefixed global variable
#44WP Bannerize Pro32281216800Text Domain Mismatch
#45MWB HubSpot for WooCommerce – CRM, Abandoned Cart, Email Marketing, Marketing Automation & Analytics33262796k+Non-prefixed global variable
#46CartBounty – Save and recover abandoned carts for WooCommerce3337039910k+Output is not escaped
#47Campi Moduli Italiani3472363500Unquoted Complex Placeholder
#48WP Mail Logging3476258300k+Nonce verification recommended
#49Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder35337410k+Nonce verification recommended
#50Sticky Chat Widget – Floating Chat Icons, Contact Form, Call, Click to Chat, Email & Message Buttons363229310k+Non-prefixed global variable