WordPress.Security.NonceVerification.Recommended
Nonce verification recommended
The code reads request data in a place where Plugin Check recommends a nonce check.
Why It Shows Up
The scan saw request handling that may not always mutate state, but still looks like a user-triggered action that should usually be protected by a nonce.
Why It Matters
Adding a nonce reduces accidental or forged requests and documents that the action is expected to originate from the plugin UI.
How to Fix
- For admin forms and action links, add and verify a nonce.
- For AJAX handlers, use `check_ajax_referer()`.
- For public read-only endpoints, document why a nonce is not required and keep input validation strict.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #1251 | Laposta Signup Basic | 28 | 276 | 67 | 2k+ | Output is not escaped | ||
| #1252 | WP to LinkedIn Auto Publish | 28 | 734 | 250 | 900 | Unsafe printing function | ||
| #1253 | Loginfy – Custom Login Page Customizer | 28 | 338 | 398 | 2k+ | Output is not escaped | ||
| #1254 | Maven Algolia | 28 | 148 | 89 | 6k+ | Non Singular String Literal Domain | ||
| #1255 | Media Hygiene: Remove or Delete Unused Images and More! | 28 | 654 | 309 | 5k+ | Non Singular String Literal Domain | ||
| #1256 | درگاه پرداخت بانک ملت ووکامرس | 28 | 61 | 130 | 2k+ | Request data is not unslashed | ||
| #1257 | MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor | 28 | 62 | 246 | 600k+ | Non-prefixed global variable | ||
| #1258 | My auctions allegro | 28 | 483 | 235 | 500 | Non Singular String Literal Domain | ||
| #1259 | My Sticky Bar – Floating Notification Bar & Sticky Header (formerly myStickymenu) | 28 | 164 | 441 | 100k+ | Non-prefixed global variable | ||
| #1260 | Notification – Custom Notifications and Alerts for WordPress | 28 | 186 | 219 | 10k+ | Non-prefixed global variable | ||
| #1261 | Notification for Telegram | 28 | 189 | 93 | 4k+ | Output is not escaped | ||
| #1262 | Opal Service | 28 | 339 | 329 | 900 | Non-prefixed global variable | ||
| #1263 | Store Hours for WooCommerce | 28 | 525 | 60 | 2k+ | Output is not escaped | ||
| #1264 | Order Tracking – WordPress Status Tracking Plugin | 28 | 619 | 773 | 3k+ | Unsafe printing function | ||
| #1265 | PDF for Contact Form 7 + Drag and Drop Template Builder | 28 | 674 | 101 | 500 | wp function not compatible with requires wp | ||
| #1266 | Perfect Brands for WooCommerce | 28 | 112 | 143 | 40k+ | Non-prefixed constant | ||
| #1267 | ووکامرس فارسی | 28 | 157 | 215 | 90k+ | Output is not escaped | ||
| #1268 | افزونه حمل و نقل ووکامرس | پست پیشتاز، تیپاکس و پیک موتوری | 28 | 131 | 190 | 20k+ | Missing nonce verification | ||
| #1269 | PHP Browser Detection | 28 | 68 | 49 | 600 | Non-prefixed function | ||
| #1270 | Pixel Gallery Addons for Elementor – Easy Grid, Creative Gallery, Drag and Drop Grid, Custom Grid Layout, Portfolio Gallery | 28 | 146 | 259 | 5k+ | Post Not In exclude | ||
| #1271 | Pixelgrade Assistant | 28 | 1,348 | 160 | 2k+ | Text Domain Mismatch | ||
| #1272 | Autopay | 28 | 769 | 334 | 3k+ | Text Domain Mismatch | ||
| #1273 | Podcast Importer SecondLine | 28 | 356 | 169 | 4k+ | Text Domain Mismatch | ||
| #1274 | Product Sync for WooCommerce | 28 | 158 | 375 | 400 | Direct Query | ||
| #1275 | PushAlert – Web Push Notifications for WordPress and WooCommerce | 28 | 196 | 63 | 1k+ | curl curl setopt | ||
| #1276 | Payment Plugins for PayPal WooCommerce | 28 | 232 | 246 | 80k+ | Non-prefixed hook name | ||
| #1277 | Query Wrangler | 28 | 628 | 229 | 700 | Output is not escaped | ||
| #1278 | Rating by BestWebSoft | 28 | 509 | 218 | 400 | Text Domain Mismatch | ||
| #1279 | ReDi Restaurant Reservation – Instant Restaurant Booking & Table Reservation System | 28 | 1,013 | 239 | 800 | Unsafe printing function | ||
| #1280 | Responsive Lightbox & Gallery | 28 | 139 | 513 | 100k+ | Non-prefixed hook name | ||
| #1281 | Brilliant Web-to-Lead for Salesforce | 28 | 247 | 244 | 2k+ | Text Domain Mismatch | ||
| #1282 | Secure Downloads | 28 | 616 | 406 | 600 | Output is not escaped | ||
| #1283 | Praison AI SEO | 28 | 649 | 306 | 1k+ | Text Domain Mismatch | ||
| #1284 | Transliterator – Multilingual and Multi-script Text Conversion | 28 | 305 | 322 | 3k+ | Output is not escaped | ||
| #1285 | Slider Pro | 28 | 583 | 527 | 4k+ | Unsafe printing function | ||
| #1286 | ST Elementor Addons | 28 | 224 | 374 | 500 | Non-prefixed global variable | ||
| #1287 | Tab – Accordion, FAQ | 28 | 104 | 542 | 1k+ | Non-prefixed global variable | ||
| #1288 | Temporary Login Without Password | 28 | 128 | 131 | 100k+ | wp function not compatible with requires wp | ||
| #1289 | Terms descriptions | 28 | 222 | 423 | 1k+ | Non-prefixed function | ||
| #1290 | Themesflat Addons For Elementor | 28 | 714 | 227 | 40k+ | Output is not escaped | ||
| #1291 | Thim Kit for Elementor – Pre-built Templates & Widgets for Elementor | 28 | 291 | 292 | 20k+ | Output is not escaped | ||
| #1292 | Ultimate FAQ Accordion Plugin | 28 | 386 | 227 | 30k+ | Unsafe printing function | ||
| #1293 | Jetpack VaultPress | 28 | 71 | 362 | 10k+ | Missing nonce verification | ||
| #1294 | VG WORT METIS | 28 | 150 | 317 | 900 | Nonce verification recommended | ||
| #1295 | WC Fields Factory | 28 | 194 | 369 | 7k+ | Nonce verification recommended | ||
| #1296 | 10WebSocial | 28 | 584 | 185 | 10k+ | Unsafe printing function | ||
| #1297 | WeeConnectPay – Clover Payment Gateway for WooCommerce | 28 | 179 | 171 | 500 | Exception output is not escaped | ||
| #1298 | PayZen for WooCommerce | 28 | 258 | 214 | 600 | Output is not escaped | ||
| #1299 | Product Gallery Slider, Additional Variation Images for WooCommerce | 28 | 552 | 316 | 20k+ | Output is not escaped | ||
| #1300 | Dynamic Product Gallery for WooCommerce | 28 | 414 | 301 | 1k+ | Output is not escaped |
