WordPress.Security.NonceVerification.Missing
Missing nonce verification
A request handler uses request data without verifying that the request was intentionally created by WordPress.
Why It Shows Up
The scan found `$_GET`, `$_POST`, or similar request data in a context where a nonce check is expected but missing.
Why It Matters
Without nonce verification, an attacker may be able to trick a logged-in user into submitting an unwanted state-changing request.
How to Fix
- Add a nonce to the form, link, AJAX request, or REST request.
- Verify it with `check_admin_referer()`, `check_ajax_referer()`, or `wp_verify_nonce()` before changing state.
- Keep capability checks separate; nonces prove intent, not permission.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #2701 | Fast User Switching | 40 | 28 | 28 | 2k+ | Output is not escaped | ||
| #2702 | Featured Post | 40 | 36 | 18 | 900 | Output is not escaped | ||
| #2703 | FluentComments – Spam protection, AntiSpam, Ajax Enhanced Comments | 40 | 50 | 47 | 700 | Non-prefixed global variable | ||
| #2704 | Flying Scripts: Delay JavaScript to Improve Site Speed & Performance | 40 | 23 | 44 | 30k+ | Missing direct file access protection | ||
| #2705 | FlyWP Helper – Page Cache, Page Optimization, Emails for FlyWP Server Control Panel | 40 | 20 | 81 | 4k+ | Non-prefixed global variable | ||
| #2706 | Fusion Page Builder | 40 | 34 | 100 | 3k+ | Input is not validated | ||
| #2707 | Analytics Germanized for Google Analytics (GDPR / DSGVO) | 40 | 49 | 14 | 8k+ | Output is not escaped | ||
| #2708 | Osom Author Pro | 40 | 83 | 22 | 1k+ | Output is not escaped | ||
| #2709 | Get Cash | 40 | 84 | 49 | 500 | Non Singular String Literal Domain | ||
| #2710 | GetPaid > Item Inventory | 40 | 112 | 52 | 400 | Text Domain Mismatch | ||
| #2711 | Gravity Forms Data Persistence Add-On Reloaded | 40 | 14 | 38 | 700 | Input is not sanitized | ||
| #2712 | Header Promo – Show Top Bar Message or Call to Action | 40 | 472 | 45 | 400 | Output is not escaped | ||
| #2713 | WP Armour – Honeypot Anti Spam | 40 | 55 | 66 | 400k+ | Missing nonce verification | ||
| #2714 | Hostinger Reach – AI-Powered Email Marketing for WordPress | 40 | 9 | 46 | 1m+ | Direct Query | ||
| #2715 | iNext Woo Pincode Checker | 40 | 36 | 82 | 700 | Missing nonce verification | ||
| #2716 | Correios Automático – Rastreio, Frete, Etiqueta, Declaração e Devolução | 40 | 32 | 56 | 4k+ | Non-prefixed global variable | ||
| #2717 | Interactive US Map | 40 | 136 | 54 | 400 | Text Domain Mismatch | ||
| #2718 | Quotes Addon for GetPaid | 40 | 191 | 21 | 700 | Text Domain Mismatch | ||
| #2719 | JSM Show Order Metadata for WooCommerce HPOS | 40 | 17 | 64 | 700 | Nonce verification recommended | ||
| #2720 | JSM Show Post Metadata | 40 | 15 | 66 | 10k+ | Nonce verification recommended | ||
| #2721 | JSM Show Term Metadata | 40 | 14 | 64 | 900 | Nonce verification recommended | ||
| #2722 | JSM Show User Metadata | 40 | 14 | 64 | 3k+ | Nonce verification recommended | ||
| #2723 | La Sentinelle antispam | 40 | 88 | 46 | 3k+ | Output is not escaped | ||
| #2724 | Limit Login Attempts | 40 | 81 | 38 | 300k+ | Output is not escaped | ||
| #2725 | LJ Multi Column Archive | 40 | 17 | 25 | 1k+ | Output is not escaped | ||
| #2726 | Loan Comparison | 40 | 27 | 192 | 400 | Request data is not unslashed | ||
| #2727 | MailerSend – Official SMTP Integration | 40 | 39 | 25 | 2k+ | Unsafe printing function | ||
| #2728 | Manual Image Crop | 40 | 178 | 61 | 8k+ | Output is not escaped | ||
| #2729 | MAS Company Reviews For WP Job Manager | 40 | 44 | 71 | 1k+ | Output is not escaped | ||
| #2730 | Mobile Contact Line | 40 | 39 | 355 | 1k+ | Non-prefixed global variable | ||
| #2731 | Modal Window – create popup modal window | 40 | 4 | 170 | 10k+ | Non-prefixed global variable | ||
| #2732 | Multiple Featured Images | 40 | 50 | 22 | 5k+ | Output is not escaped | ||
| #2733 | My Social Feeds – Social Feeds Embedder Plugin for WP | 40 | 8 | 77 | 400 | Request data is not unslashed | ||
| #2734 | Flying Images: Optimize and Lazy Load Images for Faster Page Speed | 40 | 32 | 58 | 3k+ | Missing direct file access protection | ||
| #2735 | No-Bot Registration | 40 | 112 | 42 | 2k+ | Unsafe printing function | ||
| #2736 | No CAPTCHA reCAPTCHA | 40 | 112 | 26 | 4k+ | Text Domain Mismatch | ||
| #2737 | One Click SSL | 40 | 136 | 62 | 10k+ | Unsafe printing function | ||
| #2738 | OPML Importer | 40 | 35 | 13 | 3k+ | Output is not escaped | ||
| #2739 | Pixel Tag Manager for WooCommerce – Google Analytics 4, Google Ads, and More Pixels | 40 | 68 | 249 | 3k+ | Missing nonce verification | ||
| #2740 | Plugin Load Filter | 40 | 76 | 112 | 7k+ | Text Domain Mismatch | ||
| #2741 | Popup addon for Ninja Forms | 40 | 121 | 25 | 1k+ | Output is not escaped | ||
| #2742 | Post Ratings | 40 | 160 | 32 | 600 | Output is not escaped | ||
| #2743 | Private Google Calendars | 40 | 227 | 37 | 1k+ | Output is not escaped | ||
| #2744 | Privilege Widget | 40 | 139 | 52 | 600 | Text Domain Mismatch | ||
| #2745 | Product Video Gallery for Woocommerce | 40 | 61 | 36 | 10k+ | Setting is missing a sanitization callback | ||
| #2746 | Quiz Cat – WordPress Quiz Plugin | 40 | 151 | 69 | 4k+ | Output is not escaped | ||
| #2747 | Random Banner | 40 | 59 | 125 | 1k+ | Output is not escaped | ||
| #2748 | Rename default post Labels | 40 | 54 | 36 | 600 | Text Domain Mismatch | ||
| #2749 | Responsive Full Width Background Slider | 40 | 131 | 22 | 2k+ | Unsafe printing function | ||
| #2750 | Responsive Gallery Grid | 40 | 90 | 14 | 4k+ | Output is not escaped |
