WordPress.Security.NonceVerification.Missing
Missing nonce verification
A request handler uses request data without verifying that the request was intentionally created by WordPress.
Why It Shows Up
The scan found `$_GET`, `$_POST`, or similar request data in a context where a nonce check is expected but missing.
Why It Matters
Without nonce verification, an attacker may be able to trick a logged-in user into submitting an unwanted state-changing request.
How to Fix
- Add a nonce to the form, link, AJAX request, or REST request.
- Verify it with `check_admin_referer()`, `check_ajax_referer()`, or `wp_verify_nonce()` before changing state.
- Keep capability checks separate; nonces prove intent, not permission.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #3451 | Post Featured Video | 69 | 4 | 15 | 900 | Missing nonce verification | ||
| #3452 | Sticky Header Effects for Elementor | 69 | 354 | 71 | 300k+ | Text Domain Mismatch | ||
| #3453 | Add Widget After Content | 70 | 6 | 11 | 7k+ | Setting is missing a sanitization callback | ||
| #3454 | Comment Form CSRF Protection | 70 | 7 | 10 | 500 | Request data is not unslashed | ||
| #3455 | WebDefender Security – Protection & AntiSpam | 70 | 176 | 61 | 1k+ | wp function not compatible with requires wp | ||
| #3456 | Gutenberg Blocks Templates – 50+ Free Gutenberg Block Designs | 70 | 2 | 23 | 700 | Request data is not unslashed | ||
| #3457 | Search and Replace | 70 | 7 | 9 | 10k+ | Input is not sanitized | ||
| #3458 | Simple Login Captcha | 70 | 20 | 19 | 10k+ | date date | ||
| #3459 | SQL Executioner | 70 | 18 | 17 | 2k+ | Non-prefixed global variable | ||
| #3460 | Stitch Express | 70 | 10 | 6 | 400 | Output is not escaped | ||
| #3461 | Cart All In One For WooCommerce | 70 | 6 | 150 | 5k+ | Non-prefixed global variable | ||
| #3462 | Post Template | 70 | 12 | 11 | 400 | Missing nonce verification | ||
| #3463 | aapanel WP Toolkit | 71 | 20 | 18 | 2k+ | wp function not compatible with requires wp | ||
| #3464 | Change Administrator Email Address | 71 | 12 | 9 | 700 | Output is not escaped | ||
| #3465 | Another Mailchimp Widget | 71 | 28 | 17 | 4k+ | Missing Translators Comment | ||
| #3466 | BuddyPress Default Data | 71 | 8 | 21 | 400 | Interpolated SQL is not prepared | ||
| #3467 | commonWP | 71 | 18 | 33 | 400 | Non-prefixed hook name | ||
| #3468 | Contact Form 7 Confirm Email Field | 71 | 35 | 11 | 2k+ | Text Domain Mismatch | ||
| #3469 | Privyr CRM – Instant Lead Alerts for Contact Forms | 71 | 2 | 25 | 4k+ | Non-prefixed function | ||
| #3470 | Repeater Fields for WPForms | 71 | 173 | 18 | 500 | wp function not compatible with requires wp | ||
| #3471 | Tax Switch for WooCommerce | 71 | 3 | 20 | 900 | Non-prefixed hook name | ||
| #3472 | WooCommerce Shipping | 71 | 48 | 70k+ | Direct Query | |||
| #3473 | Multi-Step Checkout for WooCommerce | 71 | 38 | 104 | 8k+ | Non-prefixed global variable | ||
| #3474 | Archiiv | 72 | 6 | 30 | 400 | Non-prefixed global variable | ||
| #3475 | Disable Title | 72 | 20 | 15 | 2k+ | Text Domain Mismatch | ||
| #3476 | Disclaimify – Affiliate Disclosure / Disclaimer for WordPress | 72 | 2 | 19 | 1k+ | Missing nonce verification | ||
| #3477 | Discontinued Product Stock Status for WooCommerce | 72 | 1 | 51 | 500 | Missing nonce verification | ||
| #3478 | PowerBI Embed Reports | 72 | 3 | 20 | 500 | Nonce verification recommended | ||
| #3479 | Getsitecontrol — Email Marketing Plugin | Popup Maker, Automations & Newsletters | 72 | 17 | 11 | 1k+ | wp function not compatible with requires wp | ||
| #3480 | Gift Wrapping for WooCommerce | 72 | 2 | 16 | 1k+ | Missing nonce verification | ||
| #3481 | Minimal Maintenance Mode | 72 | 1 | 20 | 600 | Missing nonce verification | ||
| #3482 | Non-Purchasable WooCommerce Products | 72 | 14 | 13 | 1k+ | Input is not validated | ||
| #3483 | Shipping Rate By Cities | 72 | 4 | 21 | 700 | Direct Query | ||
| #3484 | Waymark | 72 | 16 | 32 | 900 | Missing direct file access protection | ||
| #3485 | Product Subtitle For WooCommerce | 72 | 6 | 36 | 3k+ | Non-prefixed namespace | ||
| #3486 | Advanced Custom Fields – Widget Relationship Field add-on | 73 | 18 | 7 | 500 | Output is not escaped | ||
| #3487 | Contact Form7: Autocomplete | 73 | 27 | 8 | 500 | Text Domain Mismatch | ||
| #3488 | Continue Shopping for WooCommerce | 73 | 9 | 20 | 5k+ | Input is not sanitized | ||
| #3489 | Custom Datepicker NMR | 73 | 4 | 12 | 1k+ | Missing Version | ||
| #3490 | EU Withdrawal Button for WooCommerce | 73 | 27 | 400 | Missing nonce verification | |||
| #3491 | Force Password Change | 73 | 4 | 10 | 400 | Missing nonce verification | ||
| #3492 | Freetobook Responsive Widget | 73 | 5 | 14 | 500 | Input is not sanitized | ||
| #3493 | Hide WP Toolbar | 73 | 4 | 13 | 1k+ | trademarked term | ||
| #3494 | International Phone Number Format | 73 | 51 | 20 | 400 | Text Domain Mismatch | ||
| #3495 | Multifile Upload Field for Contact Form 7 | 73 | 41 | 7 | 5k+ | Text Domain Mismatch | ||
| #3496 | NETOPIA Payments Payment Gateway | 73 | 3 | 31 | 10k+ | Missing nonce verification | ||
| #3497 | POKY – Product Importer | 73 | 6 | 12 | 700 | Input is not validated | ||
| #3498 | Product Bundles – Bulk Discounts | 73 | 31 | 7 | 600 | Text Domain Mismatch | ||
| #3499 | Advanced Custom Fields: Archive Templates | 74 | 11 | 7 | 800 | Output is not escaped | ||
| #3500 | BP xProfile Location | 74 | 7 | 24 | 600 | Missing nonce verification |
