PluginScore

WordPress.DB.PreparedSQLPlaceholders.UnquotedComplexPlaceholder

Unquoted Complex Placeholder

A SQL query is built in a way that Plugin Check cannot verify as safely prepared.

critical weight

Why It Shows Up

The scan found missing, incorrect, quoted, unsupported, or mismatched SQL placeholders around `$wpdb->prepare()` usage.

Why It Matters

Broken preparation can leave dynamic SQL values unsafe or make queries behave differently than intended.

How to Fix

  • Keep placeholders in the SQL string and pass dynamic values as separate arguments.
  • Use the placeholder that matches the value type.
  • Do not quote placeholders manually, and use allowlists for identifiers or SQL fragments.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#1Razorpay for WooCommerce20974855100k+Non-prefixed function
#2SMS Extension for Contact Form 7217201,387400Non-prefixed global variable
#3MotoPress Hotel Booking213,0631,03710k+Text Domain Mismatch
#4Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred211,4783,33710k+Non-prefixed global variable
#5Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent222255198k+error log error log
#6RapidLoad AI – Optimize Web Vitals Automatically2281840700Nonce verification recommended
#7UserFeedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds22444243200k+Text Domain Mismatch
#8WooCommerce221,3596,1727m+Non-prefixed global variable
#9Easy Digital Downloads – eCommerce Payments and Subscriptions made easy233,72310,28340k+Non-prefixed namespace
#10License Manager for WooCommerce231297976k+Nonce verification recommended
#11MotoPress Appointment Booking232,3628572k+Text Domain Mismatch
#12Pricing Table by Supsystic231,29944710k+Non Singular String Literal Domain
#13WP Webhooks – Automate repetitive tasks by creating powerful automation workflows directly within WordPress234,37689020k+Output is not escaped
#14Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress232,3171,7145k+Output is not escaped
#15Awesome Support – WordPress HelpDesk & Support Plugin242251,2396k+Non-prefixed global variable
#16Product Feed Manager For WooCommerce – Sell on 200+ Online Marketplaces242,3173,37510k+slow db query meta key
#17Contact Form by Supsystic241,9136336k+Non Singular String Literal Domain
#18ELEX WooCommerce Request a Quote243982662k+Request data is not unslashed
#19Fix Alt Text245443461k+Non Singular String Literal Domain
#20Easy Google Maps241,76438920k+Non Singular String Literal Domain
#21Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails244,6961,4805k+Text Domain Mismatch
#22Mang Board WP241,2134,7209k+Non-prefixed global variable
#23NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar2426740440k+Non-prefixed hook name
#24Premmerce Product Filter for WooCommerce248171,4862k+Non-prefixed global variable
#25Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker244072,58740k+Non-prefixed hook name
#26SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery248321,8913k+Non-prefixed global variable
#27Sugar Calendar – Events Calendar, Event Tickets, and Events Management Platform2442895610k+Output is not escaped
#28Ultimate Maps by Supsystic241,03437410k+Non Singular String Literal Domain
#29UpdraftPlus: WP Backup & Migration Plugin242772993m+Non-prefixed global variable
#30WP Admin Audit241,0517811k+error log print r
#31WP Recipe Maker2449494250k+Non-prefixed global variable
#32Cryptocurrency Payment Gateway251,963589400Text Domain Mismatch
#33Events Made Easy255216,3241k+Non-prefixed function
#34Form Vibes – Save Contact Form 7 & Elementor Form Entries to Database257161,50910k+Non-prefixed global variable
#35Media Cleaner: Clean your WordPress!2526952090k+Direct Query
#36Post Snippets – Custom WordPress Code Snippets Customizer258081,65420k+Non-prefixed global variable
#37SEO Repair Kit – Meta Manager, Schema Manager, SEO Content Monitoring, GSC Integration, Keyword & Rank Tracking251969022k+Direct Query
#38ShopMagic – email automation2522814510k+Exception output is not escaped
#39STAGGS – Product Configurator Toolkit256262,180400Non-prefixed global variable
#40TrackShip for WooCommerce254059546k+Non-prefixed global variable
#41TranslatePress – Translate Multilingual sites with AI Translation254991,639400k+Non-prefixed hook name
#42Advanced Shipment Tracking for WooCommerce2549970460k+Non-prefixed global variable
#43WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards251,4311,27010k+Output is not escaped
#44ELEX WooCommerce Google Shopping (Google Product Feed)262262421k+Text Domain Mismatch
#45Kirki – Freeform Page Builder, Website Builder & Customizer26192799500k+Nonce verification recommended
#46SEO Booster264031,3311k+Non-prefixed global variable
#47Speed Booster Pack ⚡ PageSpeed Optimization Suite271081879k+Missing Translators Comment
#48Product Sync for WooCommerce28158375400Direct Query
#49FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider297478600k+Missing Translators Comment
#50WPDoctor Malware Scanner & Vulnerability Checker & IP blocker with Hack monitor Lite31133438600Non-prefixed global variable