PluginScore

WordPress.DB.PreparedSQLPlaceholders.UnsupportedIdentifierPlaceholder

Unsupported Identifier Placeholder

A SQL query is built in a way that Plugin Check cannot verify as safely prepared.

critical weight

Why It Shows Up

The scan found missing, incorrect, quoted, unsupported, or mismatched SQL placeholders around `$wpdb->prepare()` usage.

Why It Matters

Broken preparation can leave dynamic SQL values unsafe or make queries behave differently than intended.

How to Fix

  • Keep placeholders in the SQL string and pass dynamic values as separate arguments.
  • Use the placeholder that matches the value type.
  • Do not quote placeholders manually, and use allowlists for identifiers or SQL fragments.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#1WPPizza – A Restaurant Plugin184,6892,7031k+Text Domain Mismatch
#2Backup Migration219811,09380k+Non-prefixed global variable
#3GeoDirectory – WP Business Directory Plugin and Classified Listings Directory224,4653,97610k+Output is not escaped
#4LearnPress – WordPress LMS Plugin for Create and Sell Online Courses222,4333,59470k+Non-prefixed global variable
#5myCred Addons – Ultimate myCred Modules To Support WordPress Gamification and Loyalty Rewards222,3441,320400Output is not escaped
#6WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell226,0042,7645k+Text Domain Mismatch
#7Announcement & Notification Banner – Bulletin239301,5762k+Non-prefixed global variable
#8All In One Login — Login Page Security and Customization for WordPress with Google reCAPTCHA, Social Login, Temporary Login, 2FA, and more.237501,35960k+Non-prefixed global variable
#9WPBot – AI ChatBot for Live Support, Lead Generation, AI Services235141,2215k+Non-prefixed global variable
#10Conversios – GA4, Google Ads & Meta Conversion Tracking with Product Feed for WooCommerce231141,49910k+Non-prefixed global variable
#11Groundhogg — CRM, Newsletters, and Marketing Automation231369192k+Non-prefixed global variable
#12AI Popup231,224636400Text Domain Mismatch
#13Backuply – Backup, Restore, Migrate and Clone24709555600k+Non-prefixed global variable
#14CF7 Apps – Honeypot, Database, Redirection, Webhook, and Addons for Contact Form 7241,0631,397300k+Non-prefixed global variable
#15Easy Form Builder by WhiteStudio – Drag & Drop Form Builder242124331k+Nonce verification recommended
#16eCommerce Product Catalog Plugin for WordPress246213,1777k+Non-prefixed function
#17The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce2412,049494100k+Text Domain Mismatch
#18WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors241685843k+Non-prefixed class
#19WP Travel Engine – Tour Booking Plugin – Tour Operator Software242,0305,70420k+Non-prefixed global variable
#20Bulk Edit Categories and Tags – Create Thousands Quickly on the Editor251,0411,0164k+Text Domain Mismatch
#21Bulk Edit and Create User Profiles – WP Sheet Editor259951,0011k+Text Domain Mismatch
#22胖鼠采集(Fat Rat Collect)25630190900Missing Arg Domain
#23Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails255,0141,7245k+Text Domain Mismatch
#24All-in-one Sticky Floating Contact Form, Call, Click to Chat, and 50+ Social Icon Tabs – My Sticky Elements2533076040k+Non-prefixed global variable
#25Bulk Edit Products for WooCommerce – WP Sheet Editor2595796810k+Text Domain Mismatch
#26Bulk Edit Coupons for WooCommerce – WP Sheet Editor251,022982500Text Domain Mismatch
#27Bulk Edit Posts and Products in Spreadsheet259349448k+Text Domain Mismatch
#28Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty26113671300k+Non-prefixed global variable
#29Event Monster – Event Manager, Event Booking, Event Ticket & Registration26804848600Non-prefixed global variable
#30Duplicate Post28448255300k+Unsafe printing function
#31My Sticky Bar – Floating Notification Bar & Sticky Header (formerly myStickymenu)28164441100k+Non-prefixed global variable
#32WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN)2820921710k+Exception output is not escaped
#33Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization2980163200k+Nonce verification recommended
#34Raffle Play Woocommerce31151199800Output is not escaped
#35Advanced Coupons for WooCommerce Coupons & Store Credit328521420k+Non-prefixed global variable
#36Companion Sitemap Generator – Simple, Smart, and SEO-Ready33118577k+Missing Translators Comment
#37Floating Side Tab3494153600Non-prefixed global variable
#38Security Safe34193164700Missing Translators Comment
#39WP Subscription Forms – Subscription Form Plugin for WordPress34131220400Non-prefixed global variable
#40Tuskcode Map Pro for Bing Maps3559359600Direct Query
#41ShopMagic Abandoned Cart Recovery for WooCommerce3516232k+Non-prefixed global variable
#42ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce355134410k+Request data is not unslashed
#43Microsoft Clarity3653168200k+Nonce verification recommended
#44avalex – Automatisch sichere Rechtstexte372585900Direct Query
#45Encyclopedia / Glossary / Wiki37263481k+Output is not escaped
#46WPO365 | MICROSOFT 365 GRAPH MAILER371128310k+Text Domain Mismatch
#47WPEPP – Essential Security, Password Protect & Login Page Customizer3934293k+Unsupported Identifier Placeholder
#48Hostinger Reach – AI-Powered Email Marketing for WordPress409491m+Direct Query
#49Royal MCP – Secure AI Connector for Claude, ChatGPT & Gemini41223510k+Interpolated SQL is not prepared
#50WPC Smart Wishlist for WooCommerce414738100k+Output is not escaped