PluginScore

WordPress.DB.RestrictedFunctions.mysql_mysqli_connect

mysql mysqli connect

The plugin uses a raw MySQL extension or class instead of WordPress database APIs.

medium weight

Why It Shows Up

The scan found `mysql_*`, `mysqli_*`, PDO MySQL, or related database functions in plugin code.

Why It Matters

Bypassing `$wpdb` can ignore WordPress database configuration, escaping conventions, character sets, and compatibility layers.

How to Fix

  • Replace raw MySQL calls with `$wpdb` methods or higher-level WordPress APIs.
  • Use `$wpdb->prepare()` for dynamic values.
  • If a third-party library requires a database connection, isolate it and document why WordPress APIs cannot be used.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#1Administrator Z182,061799400Output is not escaped
#2WPPizza – A Restaurant Plugin184,6892,7031k+Text Domain Mismatch
#3GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership201,832720700Non Singular String Literal Domain
#4Backup Migration219991,08180k+Non-prefixed global variable
#5WP phpMyAdmin214,5286,43540k+Missing Arg Domain
#6wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin211,8291,53460k+Output is not escaped
#7Smart Popup by Supsystic223,02843910k+Non Singular String Literal Domain
#8File Manager227405201m+Unsafe printing function
#9Redirection23523457100k+Non-prefixed global variable
#10Clone2324426240k+Output is not escaped
#11WP-CRM System – Manage Clients and Projects232971,094700Non-prefixed global variable
#12Free 1-Click WordPress Migration24224244300Direct Query
#13A2 Optimized WP – Turbocharge and secure your WordPress site2427123160k+Missing Arg Domain
#14Backuply – Backup, Restore, Migrate and Clone24729553600k+Non-prefixed global variable
#15Screen Reader Accessibility – WCAG, Text-to-Speech & AI Accessibility Fixes24235330600Non-prefixed global variable
#16Softaculous241155010k+file system operations fread
#17Social Media Share Buttons & Social Sharing Icons242,4321,364100k+Unsafe printing function
#18WEB-Translation – eTranslation Multilingual252171,057400Non-prefixed function
#19TranslatePress – Translate Multilingual sites with AI Translation255811,695400k+Non-prefixed hook name
#20Social Share Icons & Social Share Buttons252,3501,32810k+Output is not escaped
#21RSS Redirect & Feedburner Alternative262772721k+Output is not escaped
#22Data Tables Generator by Supsystic2713813210k+Exception output is not escaped
#23EZ SQL Reports Shortcode Widget and DB Backup27165158500Output is not escaped
#24Void Contact Form 7 Widget For Elementor Page Builder282796610k+Text Domain Mismatch
#25Duplicate Post28445257300k+Unsafe printing function
#26Pop-up311029110k+Output is not escaped
#27Ultimate Posts Widget313098610k+Output is not escaped
#28Enhanced Text Widget341015830k+Output is not escaped
#29SSL Mixed Content Fix3453658k+Output is not escaped
#30WPPerformanceTester3594441k+Output is not escaped
#31Graphina – Charts and Graphs For Elementor391,91011310k+Text Domain Mismatch
#32SQL Executioner7018172k+Non-prefixed global variable
#33Run SQL Query78138500Non-prefixed global variable
#34WP PHP Version Display90643k+trademarked term
#35Display PHP Version966230k+Missing direct file access protection