WordPress.Security.NonceVerification.Missing
Missing nonce verification
A request handler uses request data without verifying that the request was intentionally created by WordPress.
Why It Shows Up
The scan found `$_GET`, `$_POST`, or similar request data in a context where a nonce check is expected but missing.
Why It Matters
Without nonce verification, an attacker may be able to trick a logged-in user into submitting an unwanted state-changing request.
How to Fix
- Add a nonce to the form, link, AJAX request, or REST request.
- Verify it with `check_admin_referer()`, `check_ajax_referer()`, or `wp_verify_nonce()` before changing state.
- Keep capability checks separate; nonces prove intent, not permission.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #3051 | LIQUID SPEECH BALLOON | 44 | 34 | 30 | 10k+ | Output is not escaped | ||
| #3052 | Narrative Publisher | 44 | 28 | 37 | 1k+ | Text Domain Mismatch | ||
| #3053 | Notix – Web Push Notifications | 44 | 22 | 41 | 600 | Non-prefixed global variable | ||
| #3054 | Ocean Modal Window | 44 | 26 | 44 | 10k+ | Output is not escaped | ||
| #3055 | Post Grid | 44 | 33 | 208 | 30k+ | Non-prefixed global variable | ||
| #3056 | Razorpay Subscriptions for WooCommerce | 44 | 28 | 35 | 600 | Exception output is not escaped | ||
| #3057 | senangpay | 44 | 38 | 46 | 1k+ | Text Domain Mismatch | ||
| #3058 | Shippit for WooCommerce | 44 | 127 | 26 | 900 | Text Domain Mismatch | ||
| #3059 | Unit Price for WooCommerce | 44 | 112 | 63 | 1k+ | Output is not escaped | ||
| #3060 | ReCaptcha v2 for Contact Form 7 | 44 | 12 | 30 | 200k+ | Nonce verification recommended | ||
| #3061 | WPKoi Templates for Elementor | 44 | 937 | 25 | 5k+ | Text Domain Mismatch | ||
| #3062 | Gateway zibal for Woocommerce | 44 | 70 | 24 | 6k+ | Text Domain Mismatch | ||
| #3063 | Breadcrumb – Breadcrumb for WooCommerce and Custom Post Types | 45 | 3 | 107 | 10k+ | Request data is not unslashed | ||
| #3064 | Contact Form 7 Signature Addon | 45 | 147 | 44 | 6k+ | Text Domain Mismatch | ||
| #3065 | Cookie Law Bar | 45 | 29 | 20 | 2k+ | Output is not escaped | ||
| #3066 | Extended Post Status | 45 | 27 | 27 | 1k+ | Output is not escaped | ||
| #3067 | Goftino | 45 | 16 | 20 | 10k+ | Output is not escaped | ||
| #3068 | Hyper Cache | 45 | 36 | 100 | 8k+ | Non-prefixed global variable | ||
| #3069 | Evergreen Countdown Timer | 45 | 193 | 35 | 2k+ | wp function not compatible with requires wp | ||
| #3070 | JetHost Total Care – Security & Enhancements | 45 | 10 | 85 | 800 | Direct Query | ||
| #3071 | LINE Auto Post | 45 | 19 | 11 | 500 | Heredoc Output Not Escaped | ||
| #3072 | LWS Hide Login | 45 | 5 | 58 | 20k+ | Request data is not unslashed | ||
| #3073 | Passwords Evolved | 45 | 26 | 17 | 1k+ | Output is not escaped | ||
| #3074 | Popup Box – Easily Create WordPress Popups | 45 | 7 | 151 | 7k+ | Non-prefixed global variable | ||
| #3075 | Product Visibility by User Role for WooCommerce | 45 | 36 | 35 | 6k+ | Missing Translators Comment | ||
| #3076 | Quick Interest Slider | 45 | 1 | 48 | 1k+ | Missing nonce verification | ||
| #3077 | reCAPTCHA for Asgaros Forum | 45 | 21 | 36 | 4k+ | Input is not validated | ||
| #3078 | Related Posts By PickPlugins | 45 | 4 | 84 | 3k+ | Non-prefixed global variable | ||
| #3079 | Simple Membership MailChimp Integration | 45 | 34 | 27 | 1k+ | curl curl setopt | ||
| #3080 | Slider Templates | 45 | 10 | 33 | 1k+ | Request data is not unslashed | ||
| #3081 | Specify Missing Image Dimensions | 45 | 21 | 12 | 1k+ | Unsafe printing function | ||
| #3082 | Super Blank | 45 | 131 | 56 | 9k+ | Missing direct file access protection | ||
| #3083 | SyntaxHighlighter Evolved | 45 | 33 | 46 | 20k+ | Not In Footer | ||
| #3084 | TriPay Payment Gateway | 45 | 478 | 44 | 1k+ | Text Domain Mismatch | ||
| #3085 | Payrexx Payment Gateway for WooCommerce | 45 | 18 | 117 | 2k+ | Non-prefixed class | ||
| #3086 | WP Comment Policy Checkbox | 45 | 31 | 11 | 5k+ | Output is not escaped | ||
| #3087 | wpDataTables integration for Forminator Forms | 45 | 62 | 38 | 1k+ | Text Domain Mismatch | ||
| #3088 | Avacy CMP | 46 | 7 | 90 | 500 | Non-prefixed global variable | ||
| #3089 | CDEKDelivery | 46 | 75 | 2k+ | Nonce verification recommended | |||
| #3090 | CLP Varnish Cache | 46 | 15 | 58 | 10k+ | Non-prefixed global variable | ||
| #3091 | CoSchedule | 46 | 24 | 66 | 3k+ | Nonce verification recommended | ||
| #3092 | Easy Basic Authentication – Add basic auth to site or admin area | 46 | 14 | 28 | 600 | Input is not sanitized | ||
| #3093 | Enhanced AJAX Add to Cart for WooCommerce | 46 | 90 | 78 | 600 | Missing Arg Domain | ||
| #3094 | Export Import Menus | 46 | 23 | 28 | 10k+ | Missing nonce verification | ||
| #3095 | Import Social Events | 46 | 26 | 355 | 3k+ | Non-prefixed global variable | ||
| #3096 | Live Copy Paste for Elementor – Cross Domain Copy Paste & Page Duplicator | 46 | 13 | 25 | 7k+ | Request data is not unslashed | ||
| #3097 | PickPlugins Product Designer for WooCommerce | 46 | 14 | 123 | 500 | Missing nonce verification | ||
| #3098 | Repeater Fields for Gravity Forms | 46 | 134 | 41 | 1k+ | wp function not compatible with requires wp | ||
| #3099 | RY Tools for WooCommerce | 46 | 295 | 5k+ | Non-prefixed class | |||
| #3100 | Stars Rating | 46 | 13 | 34 | 1k+ | Missing nonce verification |
