| #1 | Shopping Cart & eCommerce Store | 17 | 7,492 | 17,554 | 3k+ | | | Non-prefixed global variable |
| #2 | Pagopar – WooCommerce Gateway | 18 | 530 | 1,215 | 400 | | | Non-prefixed global variable |
| #3 | Matomo Analytics – Powerful, Privacy-First Insights for WordPress | 19 | 1,993 | 892 | 100k+ | | | Exception output is not escaped |
| #4 | Netgsm | 19 | 352 | 348 | 1k+ | | | Non-prefixed global variable |
| #5 | AweBooking – Hotel Booking System | 20 | 309 | 514 | 1k+ | | | Non-prefixed global variable |
| #6 | Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More | 20 | 2,878 | 1,988 | 1m+ | | | Non-prefixed global variable |
| #7 | Shipping for Nova Poshta | 20 | 598 | 923 | 400 | | | Output is not escaped |
| #8 | Events Manager – OpenStreetMaps | 20 | 559 | 444 | 600 | | | Output is not escaped |
| #9 | Pinpoint Booking System – Version 2 | 21 | 634 | 328 | 3k+ | | | Missing direct file access protection |
| #10 | Event Espresso – Event Registration & Ticketing Sales | 21 | 12,710 | 2,136 | 600 | | | Text Domain Mismatch |
| #11 | Campaign Monitor for WordPress | 21 | 386 | 461 | 2k+ | | | Non-prefixed global variable |
| #12 | Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages | 21 | 1,120 | 2,913 | 8k+ | | | Non-prefixed global variable |
| #13 | Five Star Restaurant Reservations – WordPress Booking Plugin | 21 | 1,101 | 1,159 | 10k+ | | | Output is not escaped |
| #14 | Seamless Donations is Sunset | 21 | 600 | 514 | 2k+ | | | Text Domain Mismatch |
| #15 | SeatReg | 21 | 350 | 1,842 | 300 | | | Missing nonce verification |
| #16 | UPC/EAN/GTIN Barcode Generator/Importer | 21 | 776 | 311 | 500 | | | Exception output is not escaped |
| #17 | URL Shortify – Simple and Easy URL Shortener | 21 | 1,509 | 2,737 | 10k+ | | | Non-prefixed global variable |
| #18 | WCFM – Frontend Manager for WooCommerce | 21 | 4,714 | 5,059 | 20k+ | | | Non-prefixed global variable |
| #19 | WP Import Export Lite | 21 | 556 | 331 | 40k+ | | | Exception output is not escaped |
| #20 | WP phpMyAdmin | 21 | 4,528 | 6,435 | 40k+ | | | Missing Arg Domain |
| #21 | wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin | 21 | 1,829 | 1,534 | 60k+ | | | Output is not escaped |
| #22 | WPScan – WordPress Security Scanner | 21 | 527 | 265 | 8k+ | | | Text Domain Mismatch |
| #23 | Events Manager – Calendar, Bookings, Tickets, Appointments and more! | 22 | 4,730 | 5,714 | 60k+ | | | Output is not escaped |
| #24 | GeoDirectory – WP Business Directory Plugin and Classified Listings Directory | 22 | 4,445 | 3,943 | 10k+ | | | Output is not escaped |
| #25 | Mailchimp for WooCommerce | 22 | 524 | 658 | 200k+ | | | Non-prefixed global variable |
| #26 | MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder | 22 | 1,120 | 3,012 | 2k+ | | | Non-prefixed global variable |
| #27 | MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. | 22 | 2,633 | 2,460 | 10k+ | | | Output is not escaped |
| #28 | NinjaFirewall (WP Edition) – Advanced Security Plugin and Firewall | 22 | 1,263 | 2,046 | 100k+ | | | Non-prefixed global variable |
| #29 | NinjaScanner – Virus & Malware scan | 22 | 596 | 551 | 30k+ | | | Non-prefixed global variable |
| #30 | Packeta | 22 | 801 | 341 | 8k+ | | | Exception output is not escaped |
| #31 | Search & Replace Everything – Quick and Easy Way to Find and Replace Text, Links | 22 | 1,037 | 1,809 | 20k+ | | | Non-prefixed global variable |
| #32 | Easy Appointment Booking & Scheduling System – Webba Booking Calendar | 22 | 1,666 | 3,471 | 2k+ | | | Non-prefixed global variable |
| #33 | Paysera Payment Gateway for WooCommerce | 22 | 1,870 | 198 | 7k+ | | | Exception output is not escaped |
| #34 | AgenWebsite Shipping – Plugin Ongkos Kirim & Generate Resi Otomatis Semua Kurir Indonesia | 22 | 1,312 | 1,171 | 500 | | | Text Domain Mismatch |
| #35 | WP Umbrella: Security Backup Restore & Monitoring | 22 | 1,019 | 1,199 | 80k+ | | | Exception output is not escaped |
| #36 | WPSSO Core – Complete Schema Markup and Meta Tags | 22 | 1,426 | 416 | 4k+ | | | Missing Translators Comment |
| #37 | Autoptimize | 23 | 288 | 191 | 800k+ | | | Output is not escaped |
| #38 | B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More | 23 | 1,347 | 411 | 10k+ | | | Text Domain Mismatch |
| #39 | Easy Digital Downloads – eCommerce Payments and Subscriptions made easy | 23 | 3,702 | 8,486 | 40k+ | | | Non-prefixed namespace |
| #40 | Flexmls® IDX Plugin | 23 | 1,270 | 1,044 | 1k+ | | | Output is not escaped |
| #41 | Simple Calendar – Google Calendar Plugin | 23 | 2,153 | 612 | 50k+ | | | Missing direct file access protection |
| #42 | InfiniteWP Client | 23 | 2,379 | 1,844 | 200k+ | | | Exception output is not escaped |
| #43 | MailPoet – Newsletters, Email Marketing, and Automation | 23 | 957 | 732 | 500k+ | | | Exception output is not escaped |
| #44 | Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress | 23 | 931 | 1,247 | 10k+ | | | Output is not escaped |
| #45 | Order Bump for WooCommerce | 23 | 1,720 | 1,562 | 600 | | | Output is not escaped |
| #46 | MyWorks Sync for WooCommerce & QuickBooks Online | 23 | 2,292 | 9,101 | 5k+ | | | Non-prefixed global variable |
| #47 | Next Active Directory Integration | 23 | 693 | 285 | 2k+ | | | Exception output is not escaped |
| #48 | NitroPack – Performance, Page Speed & Cache Plugin for Core Web Vitals, CDN & Image Optimization | 23 | 293 | 645 | 90k+ | | | Non-prefixed global variable |
| #49 | WP User Manager – User Profile Builder & Membership | 23 | 786 | 538 | 10k+ | | | Exception output is not escaped |
| #50 | Advanced Contact form 7 DB | 24 | 765 | 1,961 | 70k+ | | | Non-prefixed global variable |