PluginScore

WordPress.Security.NonceVerification.Recommended

Nonce verification recommended

The code reads request data in a place where Plugin Check recommends a nonce check.

critical weight

Why It Shows Up

The scan saw request handling that may not always mutate state, but still looks like a user-triggered action that should usually be protected by a nonce.

Why It Matters

Adding a nonce reduces accidental or forged requests and documents that the action is expected to originate from the plugin UI.

How to Fix

  • For admin forms and action links, add and verify a nonce.
  • For AJAX handlers, use `check_ajax_referer()`.
  • For public read-only endpoints, document why a nonce is not required and keep input validation strict.

References

WordPress nonces

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#751Ultra Addons for Contact Form 7241,54345260k+Text Domain Mismatch
#752Ultimate Maps by Supsystic241,03437410k+Non Singular String Literal Domain
#753Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin249382,935200k+Non-prefixed global variable
#754Ultimate Post Kit Addons for Elementor2418341230k+Missing nonce verification
#755Ultimate Product Catalog245545255k+Unsafe printing function
#756Ultimate WP Mail24400546700Unsafe printing function
#757Unlimited Elements For Elementor247102,093300k+Non-prefixed global variable
#758UpdraftPlus: WP Backup & Migration Plugin242772993m+Non-prefixed global variable
#759User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder246633,35350k+Non-prefixed global variable
#760UserFeedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds24441235200k+Text Domain Mismatch
#761Video Conferencing with Zoom241,10544010k+Unsafe printing function
#762VikRentItems Flexible Rental Management System244,7554,639600Non-prefixed global variable
#763Vimeography: Vimeo Video Gallery WordPress Plugin24982125k+Nonce verification recommended
#764Visitor Traffic Real Time Statistics2447292730k+Non-prefixed global variable
#765PDF Ink Lite – Free PDF Watermark & Password Protection242265612k+Non-prefixed global variable
#766WCMultiShipping — Mondial Relay, Inpost & Chronopost for WooCommerce247334995k+Output is not escaped
#767Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels241,6151,37770k+Text Domain Mismatch
#768Disable Updates – Updates Manager, Disable Automatic Updates, Disable All Updates2452213510k+Output is not escaped
#769Widget Detector for Elementor241,0571,5671k+Non-prefixed global variable
#770Extra Fees for WooCommerce241,1131,5697k+Non-prefixed global variable
#771Coupon Affiliates – Affiliate Plugin for WooCommerce249473,1335k+Non-prefixed global variable
#772Premmerce WooCommerce Customers Manager245641,327700Non-prefixed global variable
#773Payment Plugins Braintree For WooCommerce247317552k+Output is not escaped
#774Payment Gateway for PayPal on WooCommerce2416366410k+Non-prefixed hook name
#775pensopay Payments243962461k+Output is not escaped
#776Premmerce Permalink Manager for WooCommerce246331,33550k+Non-prefixed global variable
#777NextMove Lite – Thank You Page for WooCommerce2491685710k+Non-prefixed global variable
#778wallee24331220400Exception output is not escaped
#779Country Based Payments for WooCommerce245311,2953k+Non-prefixed global variable
#780EU VAT Assistant for WooCommerce241,7424955k+Non Singular String Literal Domain
#781European VAT Compliance Assistant for WooCommerce245153173k+Output is not escaped
#782Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers244801,2727k+Non-prefixed function
#783WPML Multilingual & Multicurrency for WooCommerce241,4531,618100k+SQL query is not prepared
#784AI ChatBot for WooCommerce – WoowBot24144524900Request data is not unslashed
#785Yoast SEO – Advanced SEO with real-time guidance and built-in AI2415938610m+Non-prefixed global variable
#786WP Admin Audit241,0517811k+error log print r
#787WP-Appbox244183902k+Missing Arg Domain
#788Auto Affiliate Links243814163k+Output is not escaped
#789WP Discourse241031141k+Nonce verification recommended
#790WP Fastest Cache – WordPress Cache Plugin245417531m+Unsafe printing function
#791Iptanus File Upload245091,32510k+Non-prefixed function
#792WP Helper Premium243,9091,5171k+Text Domain Mismatch
#793WP Hotel Booking249011,5327k+Non-prefixed global variable
#794WP Job Portal – AI-Powered Recruitment System for Company or Job Board website24781,1588k+Missing Version
#795WP-Members Membership Plugin2466938250k+Output is not escaped
#796WP Meta and Date Remover246651,31490k+Non-prefixed global variable
#797WP Notification Bell247361,591700Non-prefixed global variable
#798پارسی دیت – Parsi Date24106291100k+Non-prefixed hook name
#799WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars248611,57310k+Non-prefixed global variable
#800WP Recipe Maker2449494250k+Non-prefixed global variable