| #401 | WPML Multilingual & Multicurrency for WooCommerce | 24 | 1,453 | 1,618 | 100k+ | | | SQL query is not prepared |
| #402 | WordLift – AI powered SEO – Schema | 24 | 278 | 949 | 400 | | | Non-prefixed hook name |
| #403 | WP Admin Audit | 24 | 1,051 | 781 | 1k+ | | | error log print r |
| #404 | WP-Appbox | 24 | 418 | 390 | 2k+ | | | Missing Arg Domain |
| #405 | Iptanus File Upload | 24 | 509 | 1,325 | 10k+ | | | Non-prefixed function |
| #406 | WP Helper Premium | 24 | 3,908 | 1,515 | 1k+ | | | Text Domain Mismatch |
| #407 | WP Hotel Booking | 24 | 1,232 | 1,533 | 7k+ | | | Non-prefixed global variable |
| #408 | WP Job Portal – AI-Powered Recruitment System for Company or Job Board website | 24 | 78 | 1,158 | 8k+ | | | Missing Version |
| #409 | WP Meta and Date Remover | 24 | 665 | 1,314 | 90k+ | | | Non-prefixed global variable |
| #410 | WP RSS Aggregator – RSS Import, Feed to Post, Autoblogging, AI Content | 24 | 1,777 | 394 | 40k+ | | | Text Domain Mismatch |
| #411 | WSMS (formerly WP SMS) – SMS & MMS Notifications with OTP and 2FA for WooCommerce | 24 | 91 | 1,725 | 7k+ | | | Non-prefixed hook name |
| #412 | WP-Stateless – Google Cloud Storage | 24 | 1,036 | 482 | 4k+ | | | Non Singular String Literal Domain |
| #413 | Dynamic Team Manager – Team Member Showcase with grid, slider, table Elementor widget & shortcode | 24 | 906 | 2,003 | 900 | | | Non-prefixed global variable |
| #414 | WP Travel Engine – Tour Booking Plugin – Tour Operator Software | 24 | 2,012 | 5,689 | 20k+ | | | Non-prefixed global variable |
| #415 | Export All Posts, Products, Orders & Users | WP Ultimate Exporter | WordPress CSV Export | 24 | 363 | 1,130 | 6k+ | | | Direct Query |
| #416 | Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress | 24 | 2,581 | 2,109 | 100k+ | | | Output is not escaped |
| #417 | WP User Manager – User Profile Builder & Membership | 24 | 787 | 539 | 10k+ | | | Exception output is not escaped |
| #418 | WPeMatico RSS Feed Fetcher | 24 | 1,378 | 587 | 10k+ | | | Output is not escaped |
| #419 | WPIDE – File Manager & Code Editor | 24 | 610 | 1,386 | 40k+ | | | Non-prefixed global variable |
| #420 | WPSpeed – WordPress Speed, Cache & Performance Optimization (Core Web Vitals, PageSpeed 100) | 24 | 482 | 189 | 2k+ | | | Output is not escaped |
| #421 | WpStream – Live Streaming, Video on Demand, Pay Per View | 24 | 1,724 | 742 | 3k+ | | | Text Domain Mismatch |
| #422 | WP Travel Engine – Elementor Widgets | Create Travel Booking Website Using WordPress and Elementor | 24 | 5,907 | 2,136 | 10k+ | | | Text Domain Mismatch |
| #423 | xili-language | 24 | 1,501 | 523 | 600 | | | Output is not escaped |
| #424 | Jetpack CRM – Clients, Leads, Invoices, Billing, Email Marketing, & Automation | 24 | 1,211 | 3,152 | 30k+ | | | Non-prefixed global variable |
| #425 | Affiliates | 25 | 689 | 1,483 | 2k+ | | | Output is not escaped |
| #426 | AliExpress Dropshipping Plugin for WooCommerce Stores | 25 | 550 | 728 | 5k+ | | | Text Domain Mismatch |
| #427 | All 404 Redirect to Homepage | 25 | 140 | 301 | 200k+ | | | date date |
| #428 | Booking for Appointments and Events Calendar – Amelia | 25 | 1,487 | 480 | 90k+ | | | Exception output is not escaped |
| #429 | Appointment Booking Calendar | 25 | 327 | 1,055 | 1k+ | | | Non-prefixed global variable |
| #430 | ATUM WooCommerce Inventory Management and Stock Tracking | 25 | 2,638 | 1,304 | 10k+ | | | Non Singular String Literal Domain |
| #431 | Beaver Builder Page Builder – Drag and Drop Website Builder | 25 | 4,463 | 1,819 | 100k+ | | | Text Domain Mismatch |
| #432 | Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid | 25 | 243 | 854 | 50k+ | | | Non-prefixed global variable |
| #433 | Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment | 25 | 260 | 1,561 | 1k+ | | | Non-prefixed global variable |
| #434 | Booking Calendar Contact Form | 25 | 371 | 884 | 500 | | | Input is not validated |
| #435 | Booking Package | 25 | 1,697 | 3,977 | 10k+ | | | Missing nonce verification |
| #436 | Bookit — Booking & Appointment Calendar | 25 | 565 | 1,458 | 4k+ | | | Non-prefixed global variable |
| #437 | Breeze Cache | 25 | 218 | 800 | 400k+ | | | Non-prefixed global variable |
| #438 | Broken Link Checker | 25 | 727 | 600 | 500k+ | | | Output is not escaped |
| #439 | SilentShield – Captcha & Anti-Spam for WordPress (CF7, WPForms, Elementor, WooCommerce) | 25 | 235 | 214 | 10k+ | | | Database parameter is not escaped |
| #440 | GSheetConnector for CF7 – Connect Contact Form 7 to Google Sheets and Send Form Submissions in Real Time | 25 | 614 | 1,431 | 40k+ | | | Non-prefixed global variable |
| #441 | CheckoutWC Lite | 25 | 1,399 | 852 | 3k+ | | | Text Domain Mismatch |
| #442 | CheckView – Form & Checkout Testing | 25 | 66 | 337 | 1k+ | | | Direct Query |
| #443 | Coupon Creator | 25 | 698 | 412 | 1k+ | | | Output is not escaped |
| #444 | DecaLog | 25 | 943 | 236 | 1k+ | | | Exception output is not escaped |
| #445 | Demo Importer Plus | 25 | 58 | 239 | 10k+ | | | Non-prefixed hook name |
| #446 | Docket Cache – Object Cache Accelerator | 25 | 333 | 481 | 20k+ | | | Output is not escaped |
| #447 | ELEX WooCommerce Dynamic Pricing and Discounts | 25 | 478 | 748 | 800 | | | Text Domain Mismatch |
| #448 | WEB-Translation – eTranslation Multilingual | 25 | 217 | 1,057 | 400 | | | Non-prefixed function |
| #449 | Show Eventbrite Events – Event Feed for Eventbrite | 25 | 595 | 1,525 | 800 | | | Non-prefixed global variable |
| #450 | Event Genius – Event Management, Events Calendar, Registration, and RSVP | 25 | 181 | 1,579 | 500 | | | Non-prefixed global variable |