| #1 | Pagopar – WooCommerce Gateway | 18 | 530 | 1,215 | 400 | | | Non-prefixed global variable |
| #2 | Podlove Podcast Publisher | 18 | 2,354 | 1,433 | 3k+ | | | Output is not escaped |
| #3 | Shopping Cart & eCommerce Store | 18 | 5,373 | 17,466 | 3k+ | | | Non-prefixed global variable |
| #4 | Matomo Analytics – Powerful, Privacy-First Insights for WordPress | 19 | 1,900 | 877 | 100k+ | | | Exception output is not escaped |
| #5 | Netgsm | 19 | 334 | 308 | 1k+ | | | Setting is missing a sanitization callback |
| #6 | WP Import Export Lite | 19 | 737 | 979 | 40k+ | | | Non-prefixed global variable |
| #7 | AweBooking – Hotel Booking System | 20 | 309 | 514 | 1k+ | | | Non-prefixed global variable |
| #8 | Event Espresso – Event Registration & Ticketing Sales | 20 | 12,698 | 2,135 | 600 | | | Text Domain Mismatch |
| #9 | Shipping for Nova Poshta | 20 | 598 | 923 | 500 | | | Output is not escaped |
| #10 | Events Manager – OpenStreetMaps | 20 | 559 | 444 | 700 | | | Output is not escaped |
| #11 | Pinpoint Booking System – Version 2 | 21 | 634 | 328 | 3k+ | | | Missing direct file access protection |
| #12 | Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More | 21 | 2,572 | 1,277 | 1m+ | | | Output is not escaped |
| #13 | Campaign Monitor for WordPress | 21 | 386 | 461 | 2k+ | | | Non-prefixed global variable |
| #14 | Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages | 21 | 1,120 | 2,913 | 9k+ | | | Non-prefixed global variable |
| #15 | Five Star Restaurant Reservations – WordPress Booking Plugin | 21 | 1,101 | 1,159 | 10k+ | | | Output is not escaped |
| #16 | Seamless Donations is Sunset | 21 | 600 | 514 | 2k+ | | | Text Domain Mismatch |
| #17 | SeatReg | 21 | 312 | 1,637 | 400 | | | Missing nonce verification |
| #18 | UPC/EAN/GTIN Barcode Generator/Importer | 21 | 776 | 311 | 500 | | | Exception output is not escaped |
| #19 | URL Shortify – Simple and Easy URL Shortener | 21 | 1,511 | 2,669 | 10k+ | | | Non-prefixed global variable |
| #20 | Paysera Payment Gateway for WooCommerce | 21 | 1,868 | 196 | 7k+ | | | Exception output is not escaped |
| #21 | WP phpMyAdmin | 21 | 4,528 | 6,435 | 50k+ | | | Missing Arg Domain |
| #22 | wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin | 21 | 1,812 | 1,432 | 70k+ | | | Output is not escaped |
| #23 | WPScan – WordPress Security Scanner | 21 | 527 | 265 | 8k+ | | | Text Domain Mismatch |
| #24 | Events Manager – Calendar, Bookings, Tickets, and more! | 22 | 4,716 | 5,690 | 70k+ | | | Output is not escaped |
| #25 | GeoDirectory – WP Business Directory Plugin and Classified Listings Directory | 22 | 4,465 | 3,976 | 10k+ | | | Output is not escaped |
| #26 | MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder | 22 | 1,120 | 3,012 | 2k+ | | | Non-prefixed global variable |
| #27 | MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. | 22 | 2,625 | 2,458 | 10k+ | | | Output is not escaped |
| #28 | Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress | 22 | 919 | 1,230 | 10k+ | | | Output is not escaped |
| #29 | NinjaFirewall (WP Edition) – Advanced Security Plugin and Firewall | 22 | 1,263 | 2,046 | 100k+ | | | Non-prefixed global variable |
| #30 | NinjaScanner – Virus & Malware scan | 22 | 596 | 551 | 30k+ | | | Non-prefixed global variable |
| #31 | Packeta | 22 | 801 | 333 | 8k+ | | | Exception output is not escaped |
| #32 | Search & Replace Everything – Quick and Easy Way to Find and Replace Text, Links | 22 | 1,042 | 1,808 | 20k+ | | | Non-prefixed global variable |
| #33 | WCFM – Frontend Manager for WooCommerce | 22 | 4,731 | 5,057 | 20k+ | | | Non-prefixed global variable |
| #34 | Easy Appointment Booking & Scheduling System – Webba Booking Calendar | 22 | 1,617 | 3,380 | 2k+ | | | Non-prefixed global variable |
| #35 | WP Umbrella: Security Backup Restore & Monitoring | 22 | 970 | 999 | 80k+ | | | Exception output is not escaped |
| #36 | WPSSO Core – Complete Schema Markup and Meta Tags | 22 | 1,409 | 414 | 5k+ | | | Missing Translators Comment |
| #37 | Autoptimize | 23 | 288 | 191 | 800k+ | | | Output is not escaped |
| #38 | B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More | 23 | 1,347 | 409 | 10k+ | | | Text Domain Mismatch |
| #39 | Easy Digital Downloads – eCommerce Payments and Subscriptions made easy | 23 | 3,719 | 10,280 | 40k+ | | | Non-prefixed namespace |
| #40 | Flexmls® IDX Plugin | 23 | 1,268 | 957 | 1k+ | | | Output is not escaped |
| #41 | InfiniteWP Client | 23 | 2,287 | 1,811 | 200k+ | | | Exception output is not escaped |
| #42 | MailPoet – Newsletters, Email Marketing, and Automation | 23 | 871 | 718 | 500k+ | | | Exception output is not escaped |
| #43 | Order Bump for WooCommerce | 23 | 1,720 | 1,562 | 600 | | | Output is not escaped |
| #44 | MyWorks Sync for WooCommerce & QuickBooks Online | 23 | 2,292 | 9,101 | 5k+ | | | Non-prefixed global variable |
| #45 | Next Active Directory Integration | 23 | 683 | 284 | 2k+ | | | Exception output is not escaped |
| #46 | NitroPack – Performance, Page Speed & Cache Plugin for Core Web Vitals, CDN & Image Optimization | 23 | 311 | 635 | 90k+ | | | Output is not escaped |
| #47 | Ocean Extra | 23 | 1,494 | 2,110 | 500k+ | | | Non-prefixed global variable |
| #48 | AgenWebsite Shipping – Plugin Ongkos Kirim & Generate Resi Otomatis Semua Kurir Indonesia | 23 | 1,299 | 1,107 | 500 | | | Text Domain Mismatch |
| #49 | Advanced Contact form 7 DB | 24 | 765 | 1,961 | 70k+ | | | Non-prefixed global variable |
| #50 | Backuply – Backup, Restore, Migrate and Clone | 24 | 711 | 556 | 600k+ | | | Non-prefixed global variable |