PluginScore

WordPress.Security.NonceVerification.Recommended

Nonce verification recommended

The code reads request data in a place where Plugin Check recommends a nonce check.

critical weight

Why It Shows Up

The scan saw request handling that may not always mutate state, but still looks like a user-triggered action that should usually be protected by a nonce.

Why It Matters

Adding a nonce reduces accidental or forged requests and documents that the action is expected to originate from the plugin UI.

How to Fix

  • For admin forms and action links, add and verify a nonce.
  • For AJAX handlers, use `check_ajax_referer()`.
  • For public read-only endpoints, document why a nonce is not required and keep input validation strict.

References

WordPress nonces

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#1001WFatture for WooCommerce Fattureincloud25229774800Non-prefixed global variable
#1002XT Floating Cart for WooCommerce251,2321,9854k+Non-prefixed global variable
#1003PDF Builder for WooCommerce. Create invoices,packing slips and more253725032k+Non-prefixed global variable
#1004Product Table for WooCommerce251838965k+Non-prefixed global variable
#1005Payment Plugins for Stripe WooCommerce25349779100k+Non-prefixed global variable
#1006Pay with Vipps and MobilePay for WooCommerce258465145k+Output is not escaped
#1007HUSKY – Products Filter Professional for WooCommerce251,89590k+Non-prefixed global variable
#1008Wordfence Login Security2524841860k+Output is not escaped
#1009WP 2FA – Two-factor authentication for WordPress25283716100k+Non-prefixed global variable
#1010WP Airbnb Review Slider253256461k+Non-prefixed global variable
#1011Super Page Cache – Cloudflare Cache, Page Speed & Core Web Vitals2514335760k+Input is not sanitized
#1012Comments Extra Fields For Post,Pages and CPT25577418500Text Domain Mismatch
#1013WP Coupons and Deals – WordPress Coupon Plugin259141,4601k+Non-prefixed global variable
#1014WP-DownloadManager256075083k+Unsafe printing function
#1015WP Review Slider251,1862,2796k+Non-prefixed global variable
#1016WP Go Maps – Google Map, OpenStreetMap, Leaflet Map254,9961,008300k+Unsafe printing function
#1017WP Google Review Slider251,3662,58430k+Non-prefixed global variable
#1018WP Encryption – No.1 HTTPS plugin & One Click Free SSL Cert, HTTPS Redirect, SSL Security258751,76450k+Non-prefixed global variable
#1019Nested Pages2567456090k+Non-prefixed global variable
#1020WP-Polls2561863940k+Unsafe printing function
#1021WP Popups – WordPress Popup builder2544034230k+Output is not escaped
#1022Perfect Images: Regenerate Thumbnails, Image Sizes, WebP & AVIF2515811860k+Non-prefixed global variable
#1023Bulk Edit Posts and Products in Spreadsheet259349448k+Text Domain Mismatch
#1024SlimStat Analytics251,17787070k+Exception output is not escaped
#1025Smush – Image Optimization, Compression, Lazy Load, WebP & CDN252445681m+Non-prefixed hook name
#1026Wp Social Login and Register Social Counter258073890k+Non-prefixed global variable
#1027WP Spell Check2594,3652k+Direct Query
#1028WP Statistics – Simple, privacy-friendly Google Analytics alternative256102,465600k+Non-prefixed global variable
#1029WP Super Cache258009891m+Output is not escaped
#1030WP Time Slots Booking Form254391,1371k+Non-prefixed global variable
#1031WP TripAdvisor Review Slider251,0632,5828k+Non-prefixed global variable
#1032WP Yelp Review Slider256001,0861k+Non-prefixed global variable
#1033WPCargo Track & Trace2523955710k+Non-prefixed global variable
#1034Team Members Showcase255911,4944k+Non-prefixed global variable
#1035WPvivid Backup for MainWP258181,79410k+Missing nonce verification
#1036WPvivid — Backup, Migration & Staging259001,461900k+Non-prefixed namespace
#1037Backup, Restore and Migrate your sites with XCloner2523886410k+Input is not sanitized
#1038XT Quick View for WooCommerce251,0621,798400Non-prefixed global variable
#1039YeeMail — Email Template Builder & Customizer25606222600wp function not compatible with requires wp
#1040Video Gallery – YouTube Gallery, Playlist & Video Grid252751,0662k+Non-prefixed hook name
#1041ActiveCampaign for WooCommerce265411905k+Exception output is not escaped
#1042AfterShip Tracking – All-In-One WooCommerce Order Tracking (Free plan available)262862918k+Text Domain Mismatch
#1043AI Content Writing Assistant261,069516700Text Domain Mismatch
#1044Attesa Extra263161511k+Output is not escaped
#1045Blog Floating Button267052409k+Output is not escaped
#1046Booking Manager – Sync WP Booking Calendar – Import Events, Export Bookings to ICS Calendar265262635k+Output is not escaped
#1047Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More269727010k+error log error log
#1048Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty26113671400k+Non-prefixed global variable
#1049Conditional Logic for Woo Product Add-ons265751,352500Non-prefixed global variable
#1050Database for Contact Form 7, WPforms, Elementor forms2631748960k+Non-prefixed global variable