PluginScore

WordPress.DB.RestrictedClasses.mysql__mysqli

mysql mysqli

The plugin uses a raw MySQL extension or class instead of WordPress database APIs.

medium weight

Why It Shows Up

The scan found `mysql_*`, `mysqli_*`, PDO MySQL, or related database functions in plugin code.

Why It Matters

Bypassing `$wpdb` can ignore WordPress database configuration, escaping conventions, character sets, and compatibility layers.

How to Fix

  • Replace raw MySQL calls with `$wpdb` methods or higher-level WordPress APIs.
  • Use `$wpdb->prepare()` for dynamic values.
  • If a third-party library requires a database connection, isolate it and document why WordPress APIs cannot be used.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#1Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution181,229923100k+Exception output is not escaped
#2Backup Migration219991,08180k+Non-prefixed global variable
#3FileOrganizer – WordPress File Manager21549261200k+unlink unlink
#4Wise Chat214705155k+Output is not escaped
#5File Manager Pro – Filester22584411100k+Request data is not unslashed
#6File Manager227405201m+Unsafe printing function
#7InstaWP Connect – 1-click WP Staging & Migration2325281740k+Non-prefixed global variable
#8ManageWP Worker235015701m+Non-prefixed class
#9WP BackItUp Community Edition232579896k+Non-prefixed global variable
#10rtMedia for WordPress, BuddyPress and bbPress242932477k+Non-prefixed constant
#11Fix Alt Text245443461k+Non Singular String Literal Domain
#12WP RSS Aggregator – RSS Import, Feed to Post, Autoblogging, AI Content241,77339940k+Text Domain Mismatch
#13Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin271231373k+Non-prefixed global variable
#14WPBase Cache271891133k+Text Domain Mismatch
#15Search & Replace365053100k+Missing nonce verification
#16Transferito: WP Migration8618119300Non-prefixed global variable