| #51 | Pricing Table by Supsystic | 22 | 1,269 | 436 | 10k+ | | | Non Singular String Literal Domain |
| #52 | PageSpeed Ninja – Cache, Minify, Defer CSS JavaScript, Critical CSS, Optimize Images, Convert WebP | 22 | 984 | 407 | 5k+ | | | Unsafe printing function |
| #53 | Seraphinite Accelerator | 22 | 595 | 255 | 50k+ | | | Output is not escaped |
| #54 | Wenprise WeChatPay Payment Gateway For WooCommerce | 22 | 443 | 178 | 400 | | | Exception output is not escaped |
| #55 | Asset CleanUp: Page Speed Booster | 22 | 2,030 | 2,485 | 100k+ | | | Non-prefixed global variable |
| #56 | File Manager | 22 | 740 | 520 | 1m+ | | | Unsafe printing function |
| #57 | WP Umbrella: Security Backup Restore & Monitoring | 22 | 970 | 999 | 80k+ | | | Exception output is not escaped |
| #58 | WP Super Minify • Minify, Compress and Cache HTML, CSS & JavaScript | 22 | 164 | 257 | 8k+ | | | Non-prefixed constant |
| #59 | WP-WebAuthn | 22 | 957 | 396 | 2k+ | | | Exception output is not escaped |
| #60 | WPSSO Core – Complete Schema Markup and Meta Tags | 22 | 1,409 | 414 | 5k+ | | | Missing Translators Comment |
| #61 | YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports | 22 | 654 | 435 | 10k+ | | | Exception output is not escaped |
| #62 | AI Engine – The Chatbot, AI Framework & MCP for WordPress | 23 | 423 | 600 | 100k+ | | | error log error log |
| #63 | Affiliate Super Assistent | 23 | 1,280 | 267 | 1k+ | | | Text Domain Mismatch |
| #64 | Autoptimize | 23 | 288 | 191 | 800k+ | | | Output is not escaped |
| #65 | Business Directory Plugin – Easy Listing Directories for WordPress | 23 | 611 | 1,064 | 10k+ | | | Non-prefixed global variable |
| #66 | CallTrackingMetrics | 23 | 922 | 286 | 3k+ | | | Unsafe printing function |
| #67 | Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe | 23 | 9,358 | 26,430 | 1k+ | | | Non-prefixed global variable |
| #68 | Easy Digital Downloads – eCommerce Payments and Subscriptions made easy | 23 | 3,719 | 10,280 | 40k+ | | | Non-prefixed namespace |
| #69 | Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress | 23 | 653 | 1,510 | 50k+ | | | Non-prefixed hook name |
| #70 | Error Log Monitor | 23 | 694 | 1,414 | 20k+ | | | Non-prefixed global variable |
| #71 | Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light | 23 | 386 | 999 | 400 | | | Non-prefixed global variable |
| #72 | Finpose – Accounting for WooCommerce | 23 | 1,649 | 1,307 | 400 | | | Non-prefixed global variable |
| #73 | GAinWP Google Analytics Integration for WordPress | 23 | 525 | 176 | 8k+ | | | Output is not escaped |
| #74 | Heureka | 23 | 534 | 237 | 400 | | | Exception output is not escaped |
| #75 | InfiniteWP Client | 23 | 2,287 | 1,811 | 200k+ | | | Exception output is not escaped |
| #76 | Import WP – Export and Import CSV and XML files to WordPress | 23 | 579 | 324 | 4k+ | | | Exception output is not escaped |
| #77 | MailPoet – Newsletters, Email Marketing, and Automation | 23 | 871 | 718 | 500k+ | | | Exception output is not escaped |
| #78 | Media Library Assistant | 23 | 1,131 | 3,759 | 70k+ | | | Nonce verification recommended |
| #79 | Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider | 23 | 204 | 324 | 500k+ | | | Non-prefixed global variable |
| #80 | Next Active Directory Integration | 23 | 683 | 284 | 2k+ | | | Exception output is not escaped |
| #81 | Postie | 23 | 408 | 259 | 10k+ | | | Output is not escaped |
| #82 | Revive.so – Bulk Rewrite and Republish Blog Posts | 23 | 332 | 228 | 600 | | | Text Domain Mismatch |
| #83 | Manago AI & Leadoo AI | 23 | 644 | 429 | 1k+ | | | Unsafe printing function |
| #84 | Security Plugin, Firewall & Malware Scanner with Auto Removal | 23 | 1,204 | 789 | 40k+ | | | Output is not escaped |
| #85 | Lasso Lite – Affiliate Link Manager & Product Displays | 23 | 294 | 302 | 4k+ | | | Non-prefixed global variable |
| #86 | The Events Calendar | 23 | 3,507 | 3,849 | 600k+ | | | Text Domain Mismatch |
| #87 | W3 Total Cache | 23 | 307 | 678 | 900k+ | | | Non-prefixed global variable |
| #88 | WHMCS Bridge | 23 | 247 | 472 | 4k+ | | | Nonce verification recommended |
| #89 | PostFinance Checkout | 23 | 995 | 221 | 1k+ | | | Text Domain Mismatch |
| #90 | ManageWP Worker | 23 | 506 | 565 | 1m+ | | | Non-prefixed class |
| #91 | Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions | 23 | 1,113 | 1,863 | 9k+ | | | Output is not escaped |
| #92 | WP STAGING – WordPress Backups, Restore, Migration & Clone | 23 | 1,525 | 1,610 | 100k+ | | | Non-prefixed global variable |
| #93 | WP Ultimate CSV Importer – WordPress Import & Export for CSV, XML & Excel | 23 | 1,158 | 3,642 | 20k+ | | | Interpolated SQL is not prepared |
| #94 | Yatra – Travel Booking & Tour Operator Software | 23 | 2,242 | 4,047 | 600 | | | Non-prefixed global variable |
| #95 | 1 Click Migration & Backup: Free WordPress Migration Plugin with Zero Downtime & Easy Clone | 24 | 140 | 193 | 400 | | | Direct Query |
| #96 | 404 Solution | 24 | 483 | 1,355 | 10k+ | | | Non-prefixed class |
| #97 | Ivory Search – WordPress Search Plugin | 24 | 1,173 | 1,688 | 100k+ | | | Non-prefixed global variable |
| #98 | All-In-One Security (AIOS) – Security and Firewall | 24 | 552 | 1,228 | 1m+ | | | Non-prefixed global variable |
| #99 | Product Feed Manager For WooCommerce – Sell on 200+ Online Marketplaces | 24 | 2,317 | 3,375 | 10k+ | | | slow db query meta key |
| #100 | Complianz – GDPR/CCPA Cookie Consent | 24 | 398 | 370 | 1m+ | | | Missing Arg Domain |