WordPress.Security.NonceVerification.Missing
Missing nonce verification
A request handler uses request data without verifying that the request was intentionally created by WordPress.
Why It Shows Up
The scan found `$_GET`, `$_POST`, or similar request data in a context where a nonce check is expected but missing.
Why It Matters
Without nonce verification, an attacker may be able to trick a logged-in user into submitting an unwanted state-changing request.
How to Fix
- Add a nonce to the form, link, AJAX request, or REST request.
- Verify it with `check_admin_referer()`, `check_ajax_referer()`, or `wp_verify_nonce()` before changing state.
- Keep capability checks separate; nonces prove intent, not permission.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #2901 | Theme Blvd Importer | 41 | 25 | 58 | 500 | Missing nonce verification | ||
| #2902 | Threat Scan Plugin | 41 | 29 | 17 | 400 | Output is not escaped | ||
| #2903 | Advanced Editor Tools | 41 | 143 | 84 | 1m+ | Unsafe printing function | ||
| #2904 | Unbloater | 41 | 57 | 18 | 5k+ | Output is not escaped | ||
| #2905 | Checkout Field Editor (Checkout Manager) for WooCommerce | 41 | 9 | 88 | 400k+ | Nonce verification recommended | ||
| #2906 | Advanced Custom Stock Status | 41 | 84 | 33 | 9k+ | Output is not escaped | ||
| #2907 | WPC Product Bundles for WooCommerce | 41 | 21 | 93 | 30k+ | Missing nonce verification | ||
| #2908 | Country Based Restrictions for WooCommerce | 41 | 27 | 67 | 5k+ | Request data is not unslashed | ||
| #2909 | Quick View For WooCommerce | 41 | 44 | 44 | 1k+ | Output is not escaped | ||
| #2910 | Pay for Payment for WooCommerce | 41 | 29 | 67 | 10k+ | Missing nonce verification | ||
| #2911 | Spam Protect for Contact Form 7 | 41 | 16 | 61 | 10k+ | Request data is not unslashed | ||
| #2912 | WP Extended Search | 41 | 159 | 37 | 20k+ | Output is not escaped | ||
| #2913 | Pledged Plugins PCI Gateway for NMI and WooCommerce | 41 | 160 | 42 | 2k+ | Text Domain Mismatch | ||
| #2914 | WP Permalink Translator | 41 | 34 | 21 | 2k+ | Unsafe printing function | ||
| #2915 | WPC Composite Products for WooCommerce | 41 | 11 | 73 | 9k+ | Missing nonce verification | ||
| #2916 | WPS Hide Login | 41 | 34 | 72 | 2m+ | Nonce verification recommended | ||
| #2917 | Export WooCommerce Orders, Products, Customers & Coupons to Google Sheets | 41 | 45 | 35 | 700 | Output is not escaped | ||
| #2918 | Simple Accessibility Button | 41 | 33 | 171 | 900 | Non-prefixed global variable | ||
| #2919 | Z-Credit Checkout – WooCommerce Payment Gateway | 41 | 151 | 22 | 900 | Text Domain Mismatch | ||
| #2920 | Pricing Table – Responsive & Easy | 42 | 117 | 148 | 3k+ | Non-prefixed global variable | ||
| #2921 | ActiveTrail – Contact Form 7 | 42 | 18 | 85 | 600 | Missing nonce verification | ||
| #2922 | Admin Options Pages | 42 | 3 | 284 | 500 | Nonce verification recommended | ||
| #2923 | Agoda Affiliate Partners Text Link Generator | 42 | 4 | 40 | 500 | Interpolated SQL is not prepared | ||
| #2924 | Automatic NBSP | 42 | 24 | 16 | 3k+ | Output is not escaped | ||
| #2925 | AweSplash – Just Splash Page | 42 | 39 | 34 | 400 | Output is not escaped | ||
| #2926 | 多合一搜索自动推送管理插件-支持Baidu/Google/Bing/IndexNow/Yandex/头条 | 42 | 17 | 38 | 2k+ | Input is not sanitized | ||
| #2927 | Bazz CallBack widget | 42 | 55 | 28 | 3k+ | Unsafe printing function | ||
| #2928 | Block Temporary Email | 42 | 33 | 13 | 500 | Unsafe printing function | ||
| #2929 | Booking.com Official Search Box | 42 | 36 | 32 | 2k+ | Output is not escaped | ||
| #2930 | BP Auto Group Join | 42 | 55 | 55 | 700 | Output is not escaped | ||
| #2931 | CCAvenue Payment Gateway for WooCommerce | 42 | 53 | 40 | 3k+ | Text Domain Mismatch | ||
| #2932 | HTML Template for CF7 | 42 | 21 | 27 | 1k+ | Non-prefixed global variable | ||
| #2933 | Change Background Color for Pages, Posts, Widgets | 42 | 35 | 7 | 500 | Text Domain Mismatch | ||
| #2934 | Cities Shipping Zones for WooCommerce | 42 | 94 | 44 | 4k+ | Text Domain Mismatch | ||
| #2935 | Clover Payments for WooCommerce | 42 | 25 | 15 | 2k+ | Exception output is not escaped | ||
| #2936 | Comment Reply Email | 42 | 21 | 23 | 500 | Unsafe printing function | ||
| #2937 | Contact Form 7 add confirm | 42 | 31 | 51 | 50k+ | Text Domain Mismatch | ||
| #2938 | Cookie Notify | 42 | 15 | 54 | 400 | Input is not validated | ||
| #2939 | CookieHub – Cookie Consent Banner (DSGVO, CCPA, RGPD and GDPR compliance) | 42 | 33 | 49 | 3k+ | Output is not escaped | ||
| #2940 | Cronjob Scheduler | 42 | 20 | 36 | 1k+ | Input is not sanitized | ||
| #2941 | Custom Admin Page by BestWebSoft – Configurable WordPress Dashboard Pages Plugin | 42 | 472 | 181 | 400 | Text Domain Mismatch | ||
| #2942 | Custom Taxonomy Order | 42 | 20 | 56 | 50k+ | Output is not escaped | ||
| #2943 | CWW connector Lite – Connect Contact Form 7 & ActiveCampaign | 42 | 39 | 21 | 400 | Output is not escaped | ||
| #2944 | Dashboard Notes | 42 | 27 | 34 | 600 | Missing Arg Domain | ||
| #2945 | Dashboard Sticky Notes | 42 | 20 | 17 | 2k+ | Missing nonce verification | ||
| #2946 | Disable User Login | 42 | 25 | 19 | 5k+ | Unsafe printing function | ||
| #2947 | Storefront Online Ordering by DoorDash | 42 | 76 | 10 | 600 | Output is not escaped | ||
| #2948 | Easy Demo Import for Omega Themes | 42 | 33 | 41 | 400 | Output is not escaped | ||
| #2949 | Exclude Pages | 42 | 31 | 14 | 20k+ | Non Singular String Literal Domain | ||
| #2950 | File Media Renamer | 42 | 16 | 42 | 2k+ | Input is not sanitized |
