PluginScore

WordPress.Security.NonceVerification.Recommended

Nonce verification recommended

The code reads request data in a place where Plugin Check recommends a nonce check.

critical weight

Why It Shows Up

The scan saw request handling that may not always mutate state, but still looks like a user-triggered action that should usually be protected by a nonce.

Why It Matters

Adding a nonce reduces accidental or forged requests and documents that the action is expected to originate from the plugin UI.

How to Fix

  • For admin forms and action links, add and verify a nonce.
  • For AJAX handlers, use `check_ajax_referer()`.
  • For public read-only endpoints, document why a nonce is not required and keep input validation strict.

References

WordPress nonces

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#451Tag, Category, and Taxonomy Manager – Autotagger Automatically Add Terms2340586950k+Nonce verification recommended
#452Simple URLs – Link Cloaking, Product Displays, and Affiliate Link Management232952984k+Non-prefixed global variable
#453Image Optimizer, Resizer and CDN – Sirv236161,0041k+Output is not escaped
#454Slider by 10Web – Responsive Image Slider235,81497610k+Output is not escaped
#455Smart Marketing SMS and Newsletters Forms232,2321,0151k+Text Domain Mismatch
#456Smart Slider 323261268800k+Non-prefixed global variable
#457SportsPress – Sports Club & League Manager234592,24610k+Non-prefixed global variable
#458Strong Testimonials2319439390k+Nonce verification recommended
#459Super Video player – Fully Customizable Video Player with Playlist231,1351,6342k+Non-prefixed global variable
#460teachPress237441,5872k+SQL query is not prepared
#461Legal Terms and Conditions Popup for User Login and WooCommerce Checkout23524237700Output is not escaped
#462The Events Calendar233,5093,850700k+Text Domain Mismatch
#463The Pack Elementor addon235561,1802k+Non-prefixed global variable
#464The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid231051,013100k+Non-prefixed global variable
#465ThemeHunk Customizer233,9685826k+Text Domain Mismatch
#466Travelpayouts237691106k+Output is not escaped
#467Trinity Audio – Text to Speech AI audio player to convert content into audio231192272k+Non-prefixed global variable
#468Directory Listings WordPress plugin – uListing239471,5731k+Non-prefixed global variable
#469Ultimate Fields23371458600Alternative PHP tag found
#470Product Options and Price Calculation Formulas for WooCommerce – Uni CPO232,5141,9291k+Output is not escaped
#471UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP236942,43920k+Non-prefixed hook name
#472VK All in One Expansion Unit231,026518100k+Output is not escaped
#473W3 Total Cache23307678900k+Non-prefixed global variable
#474Cart PDF for WooCommerce235311721k+Exception output is not escaped
#475Product Table & List Builder For WooCommerce231,3622,06010k+Non-prefixed global variable
#476Easy Appointment Booking & Scheduling System – Webba Booking Calendar231,6183,3782k+Non-prefixed global variable
#477WHMCS Bridge232474724k+Nonce verification recommended
#478Billingo Plus integráció WooCommerce-hez231,119507900Text Domain Mismatch
#479PostFinance Checkout239792141k+Text Domain Mismatch
#480Widgets for WooCommerce Products on Elementor231,6591,4543k+Non-prefixed global variable
#481AgenWebsite Shipping – Plugin Ongkos Kirim & Generate Resi Otomatis Semua Kurir Indonesia231,2851,107500Text Domain Mismatch
#482Predictive Search for WooCommerce23514633700Output is not escaped
#483WP All Import – Product Import for WooCommerce231,47520920k+Non Singular String Literal Domain
#484StoreCustomizer – A plugin to Customize all WooCommerce Pages235871,42620k+Non-prefixed global variable
#485ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin237,8802,19990k+Text Domain Mismatch
#486ManageWP Worker235065651m+Non-prefixed class
#487WP BackItUp Community Edition232579896k+Non-prefixed global variable
#488Clone2324426240k+Output is not escaped
#489WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses23590876500Non-prefixed function
#490WP-CRM System – Manage Clients and Projects232971,094800Non-prefixed global variable
#491WP Crowdfunding231991,6292k+Non-prefixed global variable
#492WP Editor2350233520k+Unsafe printing function
#493WP Free SSL237351,3451k+Non-prefixed global variable
#494Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions231,1131,8629k+Output is not escaped
#495WP Hotelier236931,6352k+Non-prefixed global variable
#496Lead Form Data Collection to CRM232111,698400Non-prefixed global variable
#497WP-Lister Lite for Amazon233,0614,177800Output is not escaped
#498FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce239412,17920k+SQL query is not prepared
#499WP Mega Menu239927928k+Non-prefixed global variable
#500WP Migrate Lite – Migration Made Easy23369255200k+Exception output is not escaped