| #851 | RSS Redirect & Feedburner Alternative | 26 | 277 | 272 | 1k+ | | | Output is not escaped |
| #852 | FG Drupal to WordPress | 26 | 275 | 100 | 700 | | | Unsafe printing function |
| #853 | FG PrestaShop to WooCommerce | 26 | 254 | 94 | 900 | | | Unsafe printing function |
| #854 | FlagShip WooCommerce Shipping | 26 | 495 | 188 | 400 | | | Non Singular String Literal Domain |
| #855 | Fluent Support – Helpdesk & Customer Support Ticket System | 26 | 92 | 272 | 10k+ | | | Direct Query |
| #856 | Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager | 26 | 113 | 597 | 90k+ | | | Non-prefixed global variable |
| #857 | FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) | 26 | 594 | 417 | 2k+ | | | Exception output is not escaped |
| #858 | FV Antispam | 26 | 332 | 239 | 900 | | | Output is not escaped |
| #859 | Translate WordPress – Google Language Translator | 26 | 200 | 317 | 100k+ | | | Non-prefixed global variable |
| #860 | GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites | 26 | 286 | 216 | 500 | | | badly named files |
| #861 | Ibtana – WordPress Website Builder | 26 | 173 | 409 | 10k+ | | | Non-prefixed global variable |
| #862 | Icegram Collect – Easy Form, Lead Collection and Subscription plugin | 26 | 423 | 292 | 2k+ | | | Output is not escaped |
| #863 | Kadence Central – Site Management, Backups, Security, and Reporting | 26 | 462 | 213 | 30k+ | | | Text Domain Mismatch |
| #864 | Kirki – Freeform Page Builder, Website Builder & Customizer | 26 | 191 | 803 | 500k+ | | | Nonce verification recommended |
| #865 | Klarna for WooCommerce | 26 | 284 | 507 | 30k+ | | | Dynamic hook name |
| #866 | Landing Page Cat – Coming Soon & Maintenance Pages | 26 | 91 | 180 | 600 | | | Non-prefixed class |
| #867 | Live Composer – Free WordPress Website Builder | 26 | 1,211 | 427 | 10k+ | | | Output is not escaped |
| #868 | Login Widget With Shortcode | 26 | 335 | 198 | 6k+ | | | wp function not compatible with requires wp |
| #869 | MakeStories (for Google Web Stories) | 26 | 117 | 416 | 600 | | | Nonce verification recommended |
| #870 | MaxGalleria | 26 | 278 | 560 | 2k+ | | | Non-prefixed global variable |
| #871 | Media File Renamer: Rename for better SEO (AI-Powered) | 26 | 154 | 170 | 40k+ | | | Direct Query |
| #872 | Hotel Booking | 26 | 690 | 940 | 4k+ | | | Unsafe printing function |
| #873 | OOPSpam Anti-Spam: Spam Protection for WordPress Forms & Comments (No CAPTCHA) | 26 | 272 | 599 | 6k+ | | | Request data is not unslashed |
| #874 | Open User Map – Interactive Leaflet Maps | 26 | 895 | 988 | 10k+ | | | Non-prefixed global variable |
| #875 | Organic Builder Widgets – Simple WordPress Page Builder | 26 | 1,034 | 125 | 3k+ | | | Output is not escaped |
| #876 | Paytium: Mollie payment forms & donations | 26 | 506 | 551 | 3k+ | | | Unsafe printing function |
| #877 | PDF for WPForms + Drag and Drop Template Builder | 26 | 674 | 113 | 1k+ | | | wp function not compatible with requires wp |
| #878 | Crowdsignal Dashboard – Polls, Surveys & more | 26 | 481 | 491 | 200k+ | | | Unsafe printing function |
| #879 | Product Table For WooCommerce | 26 | 191 | 858 | 600 | | | Non-prefixed global variable |
| #880 | RestaurantPress | 26 | 265 | 518 | 600 | | | Output is not escaped |
| #881 | Send Users Email – Email Subscribers, Email Marketing Newsletter | 26 | 188 | 415 | 5k+ | | | Non-prefixed global variable |
| #882 | Sliced Invoices – WordPress Invoice Plugin | 26 | 684 | 455 | 5k+ | | | Output is not escaped |
| #883 | Video Gallery – Vimeo and YouTube Gallery | 26 | 561 | 794 | 6k+ | | | Non-prefixed global variable |
| #884 | StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart | 26 | 125 | 420 | 2k+ | | | Non-prefixed global variable |
| #885 | Tag Groups is the Advanced Way to Display Your Taxonomy Terms | 26 | 351 | 232 | 3k+ | | | Unsafe printing function |
| #886 | Theater for WordPress | 26 | 348 | 344 | 600 | | | Output is not escaped |
| #887 | Ultimate Reviews | 26 | 515 | 345 | 500 | | | Output is not escaped |
| #888 | UpdraftCentral Dashboard | 26 | 267 | 180 | 5k+ | | | Missing Translators Comment |
| #889 | URL Image Importer – Import External Images to the Media Library from URL, CSV & XML | 26 | 143 | 239 | 700 | | | Missing nonce verification |
| #890 | VikWidgetsLoader – Collection of Widgets | 26 | 1,182 | 538 | 1k+ | | | Output is not escaped |
| #891 | Virtue/Ascend/Pinnacle Toolkit | 26 | 605 | 300 | 30k+ | | | Output is not escaped |
| #892 | Visitors Online by BestWebSoft | 26 | 512 | 269 | 1k+ | | | Text Domain Mismatch |
| #893 | XL NMI Gateway for WooCommerce | 26 | 695 | 436 | 1k+ | | | Text Domain Mismatch |
| #894 | Faktur Pro for WooCommerce | 26 | 416 | 218 | 1k+ | | | Text Domain Mismatch |
| #895 | Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) | 26 | 2,652 | 2,093 | 10k+ | | | Text Domain Mismatch |
| #896 | WP Flashy Marketing Automation | 26 | 432 | 186 | 2k+ | | | Text Domain Mismatch |
| #897 | WPCOM Member | 26 | 432 | 638 | 1k+ | | | Non Singular String Literal Domain |
| #898 | Accordions – Responsive Accordion & FAQ Plugin for WordPress | 27 | 554 | 158 | 1k+ | | | Text Domain Mismatch |
| #899 | Addon Elements for Elementor (formerly Elementor Addon Elements) | 27 | 4,065 | 103 | 90k+ | | | Text Domain Mismatch |
| #900 | Divi Torque Lite – Divi Modules for the Divi Builder & Theme | 27 | 146 | 274 | 50k+ | | | Non-prefixed global variable |