PluginScore

WordPress.Security.NonceVerification.Recommended

Nonce verification recommended

The code reads request data in a place where Plugin Check recommends a nonce check.

critical weight

Why It Shows Up

The scan saw request handling that may not always mutate state, but still looks like a user-triggered action that should usually be protected by a nonce.

Why It Matters

Adding a nonce reduces accidental or forged requests and documents that the action is expected to originate from the plugin UI.

How to Fix

  • For admin forms and action links, add and verify a nonce.
  • For AJAX handlers, use `check_ajax_referer()`.
  • For public read-only endpoints, document why a nonce is not required and keep input validation strict.

References

WordPress nonces

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#651Mailchimp for WooCommerce24523663200k+Non-prefixed global variable
#652MailerPress – Newsletter, email marketing & AI automation248053,9311k+Direct Query
#653Mailjet Email Marketing2443520610k+Unsafe printing function
#654Mang Board WP241,2134,7209k+Non-prefixed global variable
#655Admin Tweaks241,507206900Text Domain Mismatch
#656Marketing Automation24440677600Non-prefixed global variable
#657Media Library Folders2488980710k+Text Domain Mismatch
#658Min and Max Quantity for WooCommerce2460345920k+Text Domain Mismatch
#659Timetable and Event Schedule by MotoPress2445623230k+Output is not escaped
#660MT Addons for Elementor243,0731,4422k+Text Domain Mismatch
#661Musician's Pack for Elementor – Music Website Widgets & Templates241,725228400Text Domain Mismatch
#662Music Player for Elementor – Audio Player & Podcast Player246081,30210k+Non-prefixed global variable
#663MxChat – AI Chatbot & Content Generation for WordPress243,2301,4052k+Text Domain Mismatch
#664My WP Customize Admin/Frontend241,2492928k+Unsafe printing function
#665My Agile Privacy® – CMP, Cookie Consent & Privacy Tools241,1706747k+Text Domain Mismatch
#666Newsletter – Send awesome emails from WordPress248982,219200k+Non-prefixed global variable
#667Newsletter Subscription Form – User Subscriptions Form, Capture Email243858291k+Non-prefixed global variable
#668NEX-Forms – Ultimate Forms Plugin for WordPress242,0081,1956k+Text Domain Mismatch
#669Nexter Extension – Security, Performance, Code Snippets & Site Toolkit2417575910k+Nonce verification recommended
#670Ninja Forms – The Contact Form Builder That Grows With You247491,533600k+Nonce verification recommended
#671NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar2426740440k+Non-prefixed hook name
#672Omnipress24169245800Non-prefixed global variable
#673Opt-Out for Google Analytics (DSGVO / GDPR)242901,9783k+Non-prefixed global variable
#674Pagar.me para WooCommerce245491165k+Text Domain Mismatch
#675Page Builder: Pagelayer – Drag and Drop website builder24769556400k+Output is not escaped
#676Pagination Styler for WooCommerce247994481k+Output is not escaped
#677Participants Database249508947k+SQL query is not prepared
#678PayPal Brasil para WooCommerce245543291k+Unsafe printing function
#679PDF for Gravity Forms + Drag And Drop Template Builder241,457260400wp function not compatible with requires wp
#680PDF Generator for WordPress Elementor245132711k+Exception output is not escaped
#681PeproDev Ultimate Invoice243792344k+Output is not escaped
#682Database Manager – WP Adminer241,0052,75220k+Non-prefixed global variable
#683PixelYourSite – Your smart PIXEL (TAG) & API Manager241,1762,416500k+Non-prefixed namespace
#684Post Slider and Post Carousel with Post Vertical Scrolling Widget – A Responsive Post Slider245991,53210k+Non-prefixed global variable
#685Post Status Notifier Lite24984451700Missing direct file access protection
#686Product Catalog Simple241,5551,9821k+Output is not escaped
#687Post Affiliate Pro24293335500Nonce verification recommended
#688Premium Blocks – Gutenberg Blocks, Patterns & Templates241403082k+Non-prefixed function
#689Premmerce Brands for WooCommerce247001,3442k+Non-prefixed global variable
#690Premmerce Product Filter for WooCommerce248171,4862k+Non-prefixed global variable
#691Product Editor Pro – WooCommerce Bulk Edit: Prices, Stock, Images, Titles, CSV Import & More242,1544,8331k+Non-prefixed global variable
#692Product Tabs Manager for WooCommerce246344822k+Text Domain Mismatch
#693Product Watermark for WooCommerce246854592k+Text Domain Mismatch
#694Products Compare for WooCommerce241,0226951k+Output is not escaped
#695ProfileGrid – User Profiles, Groups and Communities244842,4615k+Non-prefixed global variable
#696Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors2436982020k+Nonce verification recommended
#697PickPlugins Question Answer24321,413400Non-prefixed global variable
#698Quick Event Manager241523881k+Non-prefixed function
#699Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker244052,60640k+Non-prefixed hook name
#700reGenerate Thumbnails Advanced2422012270k+Unsafe printing function