WordPress.Security.NonceVerification.Missing
Missing nonce verification
A request handler uses request data without verifying that the request was intentionally created by WordPress.
Why It Shows Up
The scan found `$_GET`, `$_POST`, or similar request data in a context where a nonce check is expected but missing.
Why It Matters
Without nonce verification, an attacker may be able to trick a logged-in user into submitting an unwanted state-changing request.
How to Fix
- Add a nonce to the form, link, AJAX request, or REST request.
- Verify it with `check_admin_referer()`, `check_ajax_referer()`, or `wp_verify_nonce()` before changing state.
- Keep capability checks separate; nonces prove intent, not permission.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #1451 | Code Manager | 32 | 217 | 261 | 500 | Nonce verification recommended | ||
| #1452 | Vimeotheque – Vimeo WordPress Plugin & Video Gallery | 32 | 642 | 264 | 2k+ | Unsafe printing function | ||
| #1453 | Color and Image Swatches for Variable Product Attributes | 32 | 173 | 111 | 1k+ | Output is not escaped | ||
| #1454 | Ultimate WooCommerce Filters | 32 | 322 | 207 | 600 | Unsafe printing function | ||
| #1455 | Contact Form Builder by vcita | 32 | 666 | 174 | 700 | Text Domain Mismatch | ||
| #1456 | Cooked – Recipe Management | 32 | 462 | 275 | 3k+ | Output is not escaped | ||
| #1457 | Compliance by Hu-manity.co | 32 | 153 | 334 | 900k+ | Missing nonce verification | ||
| #1458 | CSV Import and Exporter | 32 | 83 | 138 | 1k+ | Non-prefixed global variable | ||
| #1459 | Currency Switcher for WooCommerce | 32 | 357 | 263 | 10k+ | Text Domain Mismatch | ||
| #1460 | DHL eCommerce (Benelux) for WooCommerce | 32 | 222 | 330 | 2k+ | Nonce verification recommended | ||
| #1461 | Download Attachments | 32 | 69 | 188 | 8k+ | Non-prefixed hook name | ||
| #1462 | Enter Addons – Ultimate Template Builder for Elementor | 32 | 82 | 72 | 1k+ | Output is not escaped | ||
| #1463 | Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) | 32 | 560 | 198 | 5k+ | Text Domain Mismatch | ||
| #1464 | AC's Loan Calculator | 32 | 246 | 187 | 400 | Unsafe printing function | ||
| #1465 | FA Lite – WP responsive slider plugin | 32 | 726 | 140 | 500 | Unsafe printing function | ||
| #1466 | Freesoul Deactivate Plugins – Disable plugins on individual WordPress pages | 32 | 53 | 776 | 8k+ | Nonce verification recommended | ||
| #1467 | WP Gravity Forms HubSpot | 32 | 771 | 160 | 600 | Text Domain Mismatch | ||
| #1468 | CRM Perks Integration for Gravity Forms and Salesforce | 32 | 807 | 178 | 1k+ | Text Domain Mismatch | ||
| #1469 | WP Gravity Forms Zoho CRM and Bigin | 32 | 750 | 174 | 400 | Text Domain Mismatch | ||
| #1470 | GlotPress | 32 | 403 | 103 | 500 | Unsafe printing function | ||
| #1471 | Translate WordPress with GTranslate | 32 | 82 | 364 | 900k+ | Non-prefixed global variable | ||
| #1472 | Gwolle Guestbook | 32 | 269 | 527 | 20k+ | Output is not escaped | ||
| #1473 | Honeypot Toolkit | 32 | 155 | 770 | 400 | Missing nonce verification | ||
| #1474 | HTML5 jQuery Audio Player | 32 | 251 | 153 | 1k+ | Unsafe printing function | ||
| #1475 | Image Slider Slideshow | 32 | 409 | 171 | 2k+ | Text Domain Mismatch | ||
| #1476 | Manager for IcoMoon | 32 | 270 | 68 | 400 | Short PHP open tag found | ||
| #1477 | Muslim Prayer Time-Salah/Iqamah | 32 | 155 | 179 | 400 | date date | ||
| #1478 | Members – Membership & User Role Editor Plugin | 32 | 233 | 259 | 300k+ | Output is not escaped | ||
| #1479 | WP Mobile Menu – The Mobile-Friendly Responsive Menu | 32 | 990 | 195 | 70k+ | Output is not escaped | ||
| #1480 | Moyasar | 32 | 539 | 221 | 700 | Text Domain Mismatch | ||
| #1481 | Notice Bar | 32 | 95 | 284 | 700 | Non-prefixed global variable | ||
| #1482 | Organization chart | 32 | 187 | 334 | 5k+ | SQL query is not prepared | ||
| #1483 | Pagination by BestWebSoft – Customizable WordPress Content Splitter and Navigation Plugin | 32 | 446 | 173 | 5k+ | Text Domain Mismatch | ||
| #1484 | DEPRECATED – Shipmondo – A complete shipping solution for WooCommerce | 32 | 166 | 119 | 5k+ | Output is not escaped | ||
| #1485 | Account Engagement | 32 | 115 | 74 | 2k+ | Output is not escaped | ||
| #1486 | Barion Payment Gateway for WooCommerce | 32 | 67 | 152 | 6k+ | Non-prefixed global variable | ||
| #1487 | Autopay dla WooCommerce | 32 | 95 | 83 | 900 | Output is not escaped | ||
| #1488 | Persian Admnin Fonts | 32 | 343 | 468 | 500 | Non-prefixed global variable | ||
| #1489 | PilotPress | 32 | 150 | 285 | 900 | Output is not escaped | ||
| #1490 | Post and Page Builder by BoldGrid – Visual Drag and Drop Editor | 32 | 348 | 258 | 50k+ | Output is not escaped | ||
| #1491 | Posti Shipping | 32 | 664 | 157 | 1k+ | Text Domain Mismatch | ||
| #1492 | Volunteer Sign Up Sheets | 32 | 967 | 401 | 1k+ | Output is not escaped | ||
| #1493 | Quick Featured Images | 32 | 436 | 323 | 50k+ | Non-prefixed global variable | ||
| #1494 | Restrict Usernames Emails Characters | 32 | 327 | 367 | 1k+ | Output is not escaped | ||
| #1495 | WowRevenue – Product Bundles & Bulk Discounts | 32 | 13 | 2,027 | 1k+ | Non-prefixed global variable | ||
| #1496 | RSS for Yandex Turbo | 32 | 687 | 307 | 20k+ | Unsafe printing function | ||
| #1497 | Showcase IDX Real Estate Search & Lead Capture | 32 | 123 | 52 | 2k+ | Output is not escaped | ||
| #1498 | Simple Ajax Chat – Add a Fast, Secure Chat Box | 32 | 108 | 266 | 2k+ | Output is not escaped | ||
| #1499 | Site Search 360 | 32 | 202 | 213 | 400 | Output is not escaped | ||
| #1500 | Split Test For Elementor | 32 | 98 | 132 | 3k+ | Non-prefixed global variable |
