WordPress.Security.NonceVerification.Missing
Missing nonce verification
A request handler uses request data without verifying that the request was intentionally created by WordPress.
Why It Shows Up
The scan found `$_GET`, `$_POST`, or similar request data in a context where a nonce check is expected but missing.
Why It Matters
Without nonce verification, an attacker may be able to trick a logged-in user into submitting an unwanted state-changing request.
How to Fix
- Add a nonce to the form, link, AJAX request, or REST request.
- Verify it with `check_admin_referer()`, `check_ajax_referer()`, or `wp_verify_nonce()` before changing state.
- Keep capability checks separate; nonces prove intent, not permission.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #2801 | Add-on Contact Form 7 – MailPoet 3 | 41 | 88 | 12 | 3k+ | Output is not escaped | ||
| #2802 | Add Chat App Button | 41 | 82 | 12 | 2k+ | Output is not escaped | ||
| #2803 | Advance Bank Payment Transfer Gateway | 41 | 105 | 62 | 1k+ | Text Domain Mismatch | ||
| #2804 | Advanced Excerpt | 41 | 69 | 43 | 70k+ | Unsafe printing function | ||
| #2805 | AffiliateWP – Affiliate Product Rates | 41 | 84 | 24 | 1k+ | Output is not escaped | ||
| #2806 | Age Verify | 41 | 29 | 31 | 1k+ | Output is not escaped | ||
| #2807 | AH Display Widgets | 41 | 52 | 16 | 8k+ | Text Domain Mismatch | ||
| #2808 | Amazon Web Services | 41 | 53 | 21 | 5k+ | Missing Translators Comment | ||
| #2809 | Antispam | 41 | 11 | 41 | 400 | Missing nonce verification | ||
| #2810 | Authenticator | 41 | 59 | 44 | 1k+ | Output is not escaped | ||
| #2811 | Avatar Manager | 41 | 29 | 41 | 5k+ | Unsafe printing function | ||
| #2812 | Beam me up Scotty – Back to Top Button | 41 | 71 | 38 | 1k+ | Output is not escaped | ||
| #2813 | Beautiful Cookie Consent Banner | 41 | 33 | 76 | 40k+ | Non-prefixed global variable | ||
| #2814 | BuddyPress Xprofile Custom Field Types | 41 | 39 | 189 | 4k+ | Missing nonce verification | ||
| #2815 | Bulk Auto Image Title Attribute (Image Title tag) optimizer (Image SEO) | 41 | 16 | 37 | 1k+ | Missing nonce verification | ||
| #2816 | Cache control by Cacholong | 41 | 87 | 30 | 500 | Non Singular String Literal Domain | ||
| #2817 | Carbon Copy | 41 | 64 | 89 | 3k+ | Text Domain Mismatch | ||
| #2818 | Categorized Tag Cloud | 41 | 44 | 17 | 1k+ | Output is not escaped | ||
| #2819 | Conditional Fields for Contact Form 7 | 41 | 106 | 53 | 100k+ | Output is not escaped | ||
| #2820 | CF7 Invisible reCAPTCHA | 41 | 19 | 52 | 7k+ | Request data is not unslashed | ||
| #2821 | clickskeks.at Cookiebanner | 41 | 21 | 18 | 500 | Unsafe printing function | ||
| #2822 | CMS Tree Page View – Reorder Pages with a Drag-and-Drop Tree | 41 | 121 | 96 | 50k+ | Unsafe printing function | ||
| #2823 | CoinPayments.net Payment Gateway for WooCommerce | 41 | 51 | 32 | 1k+ | Text Domain Mismatch | ||
| #2824 | Contact Form 7 Captcha | 41 | 7 | 75 | 100k+ | Request data is not unslashed | ||
| #2825 | Content Widget | 41 | 72 | 9 | 400 | Output is not escaped | ||
| #2826 | Contribuinte Checkout | 41 | 30 | 30 | 1k+ | Output is not escaped | ||
| #2827 | Controlled Admin Access | 41 | 22 | 40 | 10k+ | Nonce verification recommended | ||
| #2828 | Custom Meta | 41 | 23 | 29 | 700 | Output is not escaped | ||
| #2829 | Custom Post Type Cleanup | 41 | 70 | 12 | 1k+ | Output is not escaped | ||
| #2830 | Dashboard Notepad | 41 | 29 | 34 | 10k+ | Missing nonce verification | ||
| #2831 | Developer Loggers for Simple History | 41 | 46 | 28 | 400 | Text Domain Mismatch | ||
| #2832 | DevVN Local Store | 41 | 84 | 28 | 1k+ | Unsafe printing function | ||
| #2833 | Dinamize | 41 | 41 | 65 | 500 | Output is not escaped | ||
| #2834 | DigitalOcean Spaces Sync | 41 | 80 | 8 | 500 | Text Domain Mismatch | ||
| #2835 | DSGVO Youtube | 41 | 48 | 29 | 1k+ | Unsafe printing function | ||
| #2836 | Easy Random Quotes | 41 | 42 | 14 | 500 | Output is not escaped | ||
| #2837 | Email Address Encoder | 41 | 109 | 8 | 100k+ | wp function not compatible with requires wp | ||
| #2838 | Essential Form – The lightest plugin for contact forms, ultra lightweight and no spam | 41 | 21 | 53 | 500 | Missing nonce verification | ||
| #2839 | Payment Gateway of PayPal for WooCommerce | 41 | 44 | 184 | 7k+ | Nonce verification recommended | ||
| #2840 | Extra User Details | 41 | 84 | 15 | 1k+ | Non Singular String Literal Domain | ||
| #2841 | Fast Chat Button | 41 | 24 | 188 | 1k+ | Non-prefixed global variable | ||
| #2842 | Featured Image Generator | 41 | 31 | 16 | 1k+ | Output is not escaped | ||
| #2843 | Flexible Posts Widget | 41 | 136 | 33 | 8k+ | Output is not escaped | ||
| #2844 | Google Authenticator | 41 | 39 | 65 | 20k+ | Output is not escaped | ||
| #2845 | (Simply) Guest Author Name | 41 | 35 | 36 | 2k+ | Output is not escaped | ||
| #2846 | Hide WP Admin Login | 41 | 23 | 39 | 500 | Nonce verification recommended | ||
| #2847 | Image Editor by Pixo | 41 | 120 | 68 | 800 | Output is not escaped | ||
| #2848 | Import external attachments | 41 | 18 | 26 | 2k+ | Output is not escaped | ||
| #2849 | Infinite Ajax Scrolling Lite For Woocommerce | 41 | 33 | 28 | 500 | Output is not escaped | ||
| #2850 | Inpost Paczkomaty | 41 | 35 | 68 | 8k+ | Text Domain Mismatch |
