PluginScore

WordPress.DB.PreparedSQLPlaceholders.UnsupportedIdentifierPlaceholder

Unsupported Identifier Placeholder

A SQL query is built in a way that Plugin Check cannot verify as safely prepared.

critical weight

Why It Shows Up

The scan found missing, incorrect, quoted, unsupported, or mismatched SQL placeholders around `$wpdb->prepare()` usage.

Why It Matters

Broken preparation can leave dynamic SQL values unsafe or make queries behave differently than intended.

How to Fix

  • Keep placeholders in the SQL string and pass dynamic values as separate arguments.
  • Use the placeholder that matches the value type.
  • Do not quote placeholders manually, and use allowlists for identifiers or SQL fragments.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#1WPPizza – A Restaurant Plugin184,6892,7031k+Text Domain Mismatch
#2Backup Migration219991,08180k+Non-prefixed global variable
#3GeoDirectory – WP Business Directory Plugin and Classified Listings Directory224,4453,94310k+Output is not escaped
#4LearnPress – WordPress LMS Plugin for Create and Sell Online Courses222,3713,61770k+Non-prefixed global variable
#5myCred Addons – Ultimate myCred Modules To Support WordPress Gamification and Loyalty Rewards222,3441,320400Output is not escaped
#6All In One Login — Login Page Security and Customization for WordPress with Google reCAPTCHA, Social Login, Temporary Login, 2FA, and more.236451,41560k+Non-prefixed global variable
#7Conversios – GA4, Google Ads & Meta Conversion Tracking with Product Feed for WooCommerce23711,48810k+Non-prefixed global variable
#8AI Popup231,224636400Text Domain Mismatch
#9WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell236,2722,7795k+Text Domain Mismatch
#10Backuply – Backup, Restore, Migrate and Clone24729553600k+Non-prefixed global variable
#11Announcement & Notification Banner – Bulletin249251,5782k+Non-prefixed global variable
#12Easy Form Builder by WhiteStudio – Drag & Drop Form Builder242285091k+Nonce verification recommended
#13Mail Mint – Email Marketing, Automation & WooCommerce Emails with AI Assistance245,1791,8134k+Text Domain Mismatch
#14WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors241695993k+Non-prefixed class
#15WP Travel Engine – Tour Booking Plugin – Tour Operator Software242,0895,83920k+Non-prefixed global variable
#16Bulk Edit Categories and Tags – Create Thousands Quickly on the Editor251,0411,0163k+Text Domain Mismatch
#17Bulk Edit and Create User Profiles – WP Sheet Editor259951,0011k+Text Domain Mismatch
#18Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty25114666300k+Non-prefixed global variable
#19胖鼠采集(Fat Rat Collect)25630190800Missing Arg Domain
#20All-in-one Sticky Floating Contact Form, Call, Click to Chat, and 50+ Social Icon Tabs – My Sticky Elements2533076040k+Non-prefixed global variable
#21Bulk Edit Products for WooCommerce – WP Sheet Editor2595796810k+Text Domain Mismatch
#22Bulk Edit Coupons for WooCommerce – WP Sheet Editor251,022982500Text Domain Mismatch
#23Bulk Edit Posts and Products in Spreadsheet259349448k+Text Domain Mismatch
#24Event Monster – Event Manager, Event Booking, Event Ticket & Registration26804848600Non-prefixed global variable
#25WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN)2720622110k+Exception output is not escaped
#26Duplicate Post28445257300k+Unsafe printing function
#27My Sticky Bar – Floating Notification Bar & Sticky Header (formerly myStickymenu)28164434100k+Non-prefixed global variable
#28Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization2980164200k+Nonce verification recommended
#29SheetsPilot – AI Spreadsheet Bulk Edit for Posts, WooCommerce Products & SEO298155500unlink unlink
#30Raffle Play Woocommerce31151199800Output is not escaped
#31Advanced Coupons for WooCommerce – BOGO Coupons, Store Credit & WooCommerce Coupon Plugin328521420k+Non-prefixed global variable
#32Companion Sitemap Generator – Simple, Smart, and SEO-Ready33118576k+Missing Translators Comment
#33Floating Side Tab3494153600Non-prefixed global variable
#34Microsoft Clarity3457170200k+Nonce verification recommended
#35Security Safe34193164700Missing Translators Comment
#36ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce34643449k+Request data is not unslashed
#37WP Subscription Forms – Subscription Form Plugin for WordPress34131220400Non-prefixed global variable
#38Tuskcode Map Pro for Bing Maps3559359600Direct Query
#39ShopMagic Abandoned Cart Recovery for WooCommerce3516232k+Non-prefixed global variable
#40Radius Booking – Appointment Booking Calendar & Scheduling for Services & Events3617176400Non-prefixed global variable
#41avalex – Automatisch sichere Rechtstexte372585900Direct Query
#42Encyclopedia / Glossary / Wiki37263481k+Output is not escaped
#43Royal MCP – Secure AI Connector for Claude, ChatGPT & any LLM via MCP374713110k+Interpolated SQL is not prepared
#44WPO365 | MICROSOFT 365 GRAPH MAILER371148310k+Text Domain Mismatch
#45WPEPP – Essential Security, Password Protect & Login Page Customizer3934293k+Unsupported Identifier Placeholder
#46hCaptcha for WP411182070k+Exception output is not escaped
#47WPC Smart Wishlist for WooCommerce414738100k+Output is not escaped
#48Link Manager – Analyze, Automate, and Monitor Links4231671k+Direct Query
#49Geo Blocker – Control Site Access by Region and IP4210641k+Direct Query
#50WP Mail Log43402910k+Text Domain Mismatch