WordPress.DB.PreparedSQLPlaceholders.UnsupportedPlaceholder
Unsupported Placeholder
A SQL query is built in a way that Plugin Check cannot verify as safely prepared.
Why It Shows Up
The scan found missing, incorrect, quoted, unsupported, or mismatched SQL placeholders around `$wpdb->prepare()` usage.
Why It Matters
Broken preparation can leave dynamic SQL values unsafe or make queries behave differently than intended.
How to Fix
- Keep placeholders in the SQL string and pass dynamic values as separate arguments.
- Use the placeholder that matches the value type.
- Do not quote placeholders manually, and use allowlists for identifiers or SQL fragments.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #1 | Feeds for YouTube (YouTube video, channel, and gallery plugin) | 21 | 558 | 978 | 100k+ | Output is not escaped | ||
| #2 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses | 22 | 2,433 | 3,594 | 70k+ | Non-prefixed global variable | ||
| #3 | Welcart e-Commerce | 22 | 10,368 | 10,882 | 10k+ | Text Domain Mismatch | ||
| #4 | CLUEVO LMS, E-Learning Platform | 23 | 1,843 | 1,176 | 400 | Text Domain Mismatch | ||
| #5 | All-In-One Security (AIOS) – Security and Firewall | 24 | 552 | 1,228 | 1m+ | Non-prefixed global variable | ||
| #6 | Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder | 24 | 4,745 | 1,279 | 30k+ | Non Singular String Literal Domain | ||
| #7 | WP Travel Engine – Tour Booking Plugin – Tour Operator Software | 24 | 2,030 | 5,704 | 20k+ | Non-prefixed global variable | ||
| #8 | ATUM WooCommerce Inventory Management and Stock Tracking | 25 | 2,611 | 1,296 | 10k+ | Non Singular String Literal Domain | ||
| #9 | Smash Balloon Social Photo Feed – Easy Social Feeds Plugin | 25 | 440 | 1,327 | 1m+ | Interpolated SQL is not prepared | ||
| #10 | WP Time Slots Booking Form | 25 | 439 | 1,137 | 1k+ | Non-prefixed global variable | ||
| #11 | EZ SQL Reports Shortcode Widget and DB Backup | 27 | 165 | 158 | 500 | Output is not escaped | ||
| #12 | Sign-up Sheets | 27 | 325 | 363 | 1k+ | Output is not escaped | ||
| #13 | WPComplete | 29 | 383 | 333 | 1k+ | Output is not escaped | ||
| #14 | ActiveDEMAND | 32 | 157 | 161 | 1k+ | Output is not escaped | ||
| #15 | Restrict Usernames Emails Characters | 32 | 327 | 367 | 1k+ | Output is not escaped | ||
| #16 | Two Factor Authentication | 35 | 108 | 139 | 20k+ | Output is not escaped | ||
| #17 | Cache Images | 39 | 72 | 27 | 1k+ | Unsafe printing function | ||
| #18 | Mollie Forms | 41 | 14 | 565 | 3k+ | Request data is not unslashed |
