PluginScore

WordPress.Security.NonceVerification.Recommended

Nonce verification recommended

The code reads request data in a place where Plugin Check recommends a nonce check.

critical weight

Why It Shows Up

The scan saw request handling that may not always mutate state, but still looks like a user-triggered action that should usually be protected by a nonce.

Why It Matters

Adding a nonce reduces accidental or forged requests and documents that the action is expected to originate from the plugin UI.

How to Fix

  • For admin forms and action links, add and verify a nonce.
  • For AJAX handlers, use `check_ajax_referer()`.
  • For public read-only endpoints, document why a nonce is not required and keep input validation strict.

References

WordPress nonces

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#1BulletProof Security05,0484,94920k+Output is not escaped
#2Intercom060716k+Non-prefixed function
#3Live Shopping & Shoppable Videos For WooCommerce079174400Non-prefixed global variable
#4Plugin Check (PCP)012814010k+Non-prefixed global variable
#5Themify Builder95,3342,1715k+Text Domain Mismatch
#6JetBackup – Backup, Restore & Migrate101,565156200k+Exception output is not escaped
#7404 Solution155711,50010k+Non-prefixed class
#8Easy WP SMTP – WordPress SMTP and Email Logs: Gmail SMTP, Office 365, Outlook, Custom SMTP, and more1545166500k+Database parameter is not escaped
#9RestroPress – Online Food Ordering System165363,2061k+Non-prefixed global variable
#10MDTF – Meta Data and Taxonomies Filter161,5501,9561k+Non-prefixed global variable
#11AnyComment174454495k+Output is not escaped
#12Efí Bank17886553400Exception output is not escaped
#13Shopping Cart & eCommerce Store178,03817,4643k+Non-prefixed global variable
#14wpForo Forum174,3063,02620k+Unsafe printing function
#15WPtouch – Make your WordPress Website Mobile-Friendly171,46632550k+Text Domain Mismatch
#16Administrator Z182,061799400Output is not escaped
#17Pagopar – WooCommerce Gateway185301,215400Non-prefixed global variable
#18Property Hive181,9576,0273k+Missing nonce verification
#19WPPizza – A Restaurant Plugin184,6892,7031k+Text Domain Mismatch
#20Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons1910,340360100k+Text Domain Mismatch
#21Block Slider – Responsive Image Slider, Video Slider & Post Slider195551,2913k+Non-prefixed global variable
#22Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution191,227892100k+Exception output is not escaped
#23GiveWP – Donation Plugin and Fundraising Platform193,4143,559100k+Output is not escaped
#24Go Fetch Jobs (for WP Job Manager)191,4101,741700Non-prefixed global variable
#25AI Infographic Maker191,383599600Output is not escaped
#26JetFormBuilder — Dynamic Blocks Form Builder192,1031,60580k+Text Domain Mismatch
#27Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps)193,2753,2289k+Output is not escaped
#28Matomo Analytics – Powerful, Privacy-First Insights for WordPress191,900877100k+Exception output is not escaped
#29Netgsm193343081k+Setting is missing a sanitization callback
#30Verified Reviews (Avis Vérifiés)196711,136700Non-prefixed global variable
#31Razorpay Payment Button Plugin19486982k+Exception output is not escaped
#32Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)195363793m+Missing Translators Comment
#33Membership Plugin – Kadence Memberships195,0832,9829k+Text Domain Mismatch
#34Scrollsequence – Cinematic Scroll Image Animation Plugin198781,5283k+Non-prefixed global variable
#35SendPress Newsletters192,2931,4221k+Output is not escaped
#36SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments195331,15080k+Non-prefixed global variable
#37WP Email Template193443452k+Exception output is not escaped
#38WP Import Export Lite1973797940k+Non-prefixed global variable
#39WP Directory Kit191,5022,6412k+Non-prefixed global variable
#40WPJAM Basic193253464k+Output is not escaped
#41WPOSS阿里云对象存储19269315900Non-prefixed namespace
#42AweBooking – Hotel Booking System203095141k+Non-prefixed global variable
#43Brizy – Page Builder2058572670k+Output is not escaped
#44Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC)207362,112900Non-prefixed global variable
#45SysBasics Customize My Account for WooCommerce – Live My Account Customizer207439118k+Non-prefixed global variable
#46Download Monitor204231,36480k+Non-prefixed hook name
#47Event Espresso – Event Registration & Ticketing Sales2012,6982,135600Text Domain Mismatch
#48Event Organiser201,10454420k+Text Domain Mismatch
#49Event Prime – Events Calendar, Bookings and Tickets208464,2117k+Non-prefixed global variable
#50GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership201,832720700Non Singular String Literal Domain