WordPress.Security.NonceVerification.Recommended
Nonce verification recommended
The code reads request data in a place where Plugin Check recommends a nonce check.
Why It Shows Up
The scan saw request handling that may not always mutate state, but still looks like a user-triggered action that should usually be protected by a nonce.
Why It Matters
Adding a nonce reduces accidental or forged requests and documents that the action is expected to originate from the plugin UI.
How to Fix
- For admin forms and action links, add and verify a nonce.
- For AJAX handlers, use `check_ajax_referer()`.
- For public read-only endpoints, document why a nonce is not required and keep input validation strict.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #1301 | Dynamic Product Gallery for WooCommerce | 28 | 414 | 301 | 1k+ | Output is not escaped | ||
| #1302 | Email Inquiry & Cart Options for WooCommerce | 28 | 181 | 273 | 800 | Output is not escaped | ||
| #1303 | Product Sort and Display for WooCommerce | 28 | 190 | 229 | 2k+ | Output is not escaped | ||
| #1304 | WP Booking System – Booking Calendar | 28 | 502 | 549 | 20k+ | Output is not escaped | ||
| #1305 | WP GoToWebinar | 28 | 207 | 207 | 700 | Non-prefixed function | ||
| #1306 | WP Mapbox GL JS Maps | 28 | 104 | 119 | 1k+ | Output is not escaped | ||
| #1307 | Connect Matomo – Analytics Dashboard for WordPress | 28 | 100 | 102 | 60k+ | Missing Translators Comment | ||
| #1308 | WP YouTube Lyte | 28 | 204 | 178 | 20k+ | Non-prefixed global variable | ||
| #1309 | WPify Woo – Withdrawal, CRN/VAT, QR payments, Heureka and more for WooCommerce | 28 | 177 | 226 | 5k+ | Output is not escaped | ||
| #1310 | WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) | 28 | 209 | 217 | 10k+ | Exception output is not escaped | ||
| #1311 | WPS Bidouille | 28 | 472 | 215 | 10k+ | Output is not escaped | ||
| #1312 | WP Synchro – The Ultimate WordPress Migration Tool | 28 | 243 | 244 | 2k+ | Missing Translators Comment | ||
| #1313 | WxSync-标准云微信公众号文章免费采集-任意公众号自动采集付费购买 | 28 | 57 | 138 | 500 | Request data is not unslashed | ||
| #1314 | Accordion Slider | 29 | 391 | 447 | 2k+ | Unsafe printing function | ||
| #1315 | Advanced coupon for WooCommerce | 29 | 472 | 242 | 900 | Text Domain Mismatch | ||
| #1316 | Adminimize | 29 | 296 | 691 | 200k+ | Non-prefixed global variable | ||
| #1317 | AL Pack | 29 | 13 | 816 | 2k+ | Non-prefixed global variable | ||
| #1318 | Alt Text AI – Automatically generate image alt text for SEO and accessibility | 29 | 72 | 280 | 20k+ | Non-prefixed global variable | ||
| #1319 | AppPresser – Mobile App Framework | 29 | 262 | 214 | 1k+ | Text Domain Mismatch | ||
| #1320 | aThemeArt Theme Helper | 29 | 206 | 151 | 2k+ | Non-prefixed global variable | ||
| #1321 | Attribute Stock for WooCommerce – Shared Stock & Variable Quantities (Lite Version) | 29 | 481 | 313 | 2k+ | Text Domain Mismatch | ||
| #1322 | Better Google Analytics | 29 | 376 | 869 | 2k+ | Non-prefixed global variable | ||
| #1323 | Bitcoin Payments – Blockonomics | 29 | 208 | 227 | 2k+ | Output is not escaped | ||
| #1324 | Plugin BlueX for WooCommerce | 29 | 431 | 216 | 2k+ | Text Domain Mismatch | ||
| #1325 | BNE Testimonials | 29 | 521 | 102 | 1k+ | Output is not escaped | ||
| #1326 | Order Delivery Date Time & Pickup for WooCommerce | 29 | 667 | 244 | 500 | Output is not escaped | ||
| #1327 | Branded Social Images – Open Graph Images with logo and extra text layer | 29 | 254 | 91 | 900 | Non Singular String Literal Domain | ||
| #1328 | Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms | 29 | 236 | 369 | 2k+ | Non-prefixed global variable | ||
| #1329 | Chained Quiz | 29 | 1,132 | 721 | 1k+ | Text Domain Mismatch | ||
| #1330 | CloudSecure WP Security | 29 | 74 | 350 | 100k+ | Request data is not unslashed | ||
| #1331 | Countdown, Coming Soon, Maintenance – Countdown & Clock | 29 | 1,735 | 143 | 10k+ | Non Singular String Literal Domain | ||
| #1332 | WPCS – WordPress Currency Switcher Professional | 29 | 84 | 358 | 900 | Non-prefixed global variable | ||
| #1333 | Custom Field Template | 29 | 568 | 530 | 30k+ | wp function not compatible with requires wp | ||
| #1334 | Di Themes Demo Site Importer | 29 | 343 | 183 | 1k+ | Text Domain Mismatch | ||
| #1335 | Display Tweets | 29 | 135 | 135 | 900 | Non-prefixed global variable | ||
| #1336 | Document Gallery | 29 | 183 | 98 | 8k+ | Output is not escaped | ||
| #1337 | Interactive Image Map Plugin – Draw Attention | 29 | 620 | 227 | 20k+ | Output is not escaped | ||
| #1338 | ECPay Ecommerce for WooCommerce | 29 | 248 | 370 | 2k+ | Missing nonce verification | ||
| #1339 | Everest Toolkit | 29 | 145 | 141 | 1k+ | Missing Translators Comment | ||
| #1340 | FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider | 29 | 74 | 78 | 600k+ | Missing Translators Comment | ||
| #1341 | Getwid – Gutenberg Blocks | 29 | 139 | 173 | 50k+ | Non-prefixed global variable | ||
| #1342 | Gianism | 29 | 391 | 154 | 700 | Text Domain Mismatch | ||
| #1343 | reCaptcha by BestWebSoft | 29 | 474 | 272 | 100k+ | Text Domain Mismatch | ||
| #1344 | Easy HTTPS Redirection (SSL) | 29 | 266 | 152 | 100k+ | Unsafe printing function | ||
| #1345 | Image Hover Effects Ultimate ( Image Gallery, Effects, Lightbox, Comparison & Magnifier ) | 29 | 20 | 826 | 20k+ | Non-prefixed namespace | ||
| #1346 | Integration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms | 29 | 625 | 351 | 1k+ | Text Domain Mismatch | ||
| #1347 | Interactive World Map | 29 | 684 | 341 | 1k+ | Text Domain Mismatch | ||
| #1348 | Wishlist for WooCommerce | 29 | 610 | 296 | 600 | Output is not escaped | ||
| #1349 | Kits, Templates and Patterns | 29 | 380 | 91 | 5k+ | Text Domain Mismatch | ||
| #1350 | Liteweight Podcast – Host and Embed Podcast Episodes | 29 | 536 | 239 | 500 | Output is not escaped |
