WordPress.Security.NonceVerification.Recommended
Nonce verification recommended
The code reads request data in a place where Plugin Check recommends a nonce check.
Why It Shows Up
The scan saw request handling that may not always mutate state, but still looks like a user-triggered action that should usually be protected by a nonce.
Why It Matters
Adding a nonce reduces accidental or forged requests and documents that the action is expected to originate from the plugin UI.
How to Fix
- For admin forms and action links, add and verify a nonce.
- For AJAX handlers, use `check_ajax_referer()`.
- For public read-only endpoints, document why a nonce is not required and keep input validation strict.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #1401 | PublishPress Blocks – Block Controls, Block Visibility, Block Permissions | 30 | 239 | 417 | 20k+ | Non-prefixed global variable | ||
| #1402 | AI Product Tools – Bulk Product Content Generator & AI Toolkit for WooCommerce | 30 | 508 | 562 | 500 | SQL query is not prepared | ||
| #1403 | Aitasi Coming Soon | 30 | 516 | 186 | 1k+ | Output is not escaped | ||
| #1404 | ApplyOnline – Application Form Builder and Manager | 30 | 345 | 244 | 2k+ | Output is not escaped | ||
| #1405 | Contact Form 7 Connector | 30 | 324 | 196 | 5k+ | Text Domain Mismatch | ||
| #1406 | AutoWP – AI Content Writer & Rewriter | 30 | 548 | 370 | 1k+ | Text Domain Mismatch | ||
| #1407 | Private groups | 30 | 583 | 316 | 1k+ | Unsafe printing function | ||
| #1408 | Blockons – Gutenberg blocks for WordPress and WooCommerce websites | 30 | 69 | 205 | 700 | Non-prefixed global variable | ||
| #1409 | BrightEdge Autopilot | 30 | 108 | 31 | 600 | curl curl setopt | ||
| #1410 | Sliding Cart for WooCommerce by FunnelKit – Skip Cart & Reach WooCommerce Checkout Faster | 30 | 306 | 434 | 30k+ | Non-prefixed global variable | ||
| #1411 | Classic Addons – WPBakery Page Builder | 30 | 1,245 | 263 | 3k+ | Text Domain Mismatch | ||
| #1412 | Classified Listing Toolkits | 30 | 43 | 1,859 | 4k+ | Non-prefixed global variable | ||
| #1413 | Colete-Online | 30 | 776 | 346 | 600 | Text Domain Mismatch | ||
| #1414 | ContentBot AI Writer (AI Content) | 30 | 317 | 69 | 500 | rand rand | ||
| #1415 | Cryptocurrency Donation Box – Bitcoin & Crypto Donations | 30 | 334 | 284 | 500 | Output is not escaped | ||
| #1416 | Custom Search by BestWebSoft – WordPress Custom Search Plugin | 30 | 454 | 228 | 900 | Text Domain Mismatch | ||
| #1417 | DethemeKit for Elementor | 30 | 335 | 228 | 30k+ | Output is not escaped | ||
| #1418 | EDI – Обмен данными между WooCommerce и 1С | 30 | 284 | 101 | 600 | Text Domain Mismatch | ||
| #1419 | Easy Affiliate Links | 30 | 186 | 198 | 7k+ | Missing direct file access protection | ||
| #1420 | Easy Custom Auto Excerpt | 30 | 84 | 166 | 6k+ | Non-prefixed global variable | ||
| #1421 | EasyParcel Shipping– All-in-one Shipping Solution, Real-Time Shipping Rates | 30 | 37 | 608 | 600 | Non-prefixed global variable | ||
| #1422 | Edwiser Bridge – WordPress Moodle Integration | 30 | 4 | 669 | 4k+ | Non-prefixed hook name | ||
| #1423 | Element Invader – Template Kits for Elementor | 30 | 274 | 130 | 3k+ | Output is not escaped | ||
| #1424 | Email Templates Customizer and Designer for WordPress and WooCommerce | 30 | 250 | 349 | 20k+ | Non-prefixed global variable | ||
| #1425 | Epeken All Kurir for Woocommerce | 30 | 590 | 1,246 | 500 | Missing nonce verification | ||
| #1426 | Eway Payment Gateway | 30 | 509 | 92 | 800 | Missing Translators Comment | ||
| #1427 | Exclusive Addons for Elementor | 30 | 3,630 | 263 | 50k+ | Text Domain Mismatch | ||
| #1428 | PiWeb Export Customers Users & Guest customer to CSV for WooCommerce | 30 | 173 | 75 | 1k+ | Text Domain Mismatch | ||
| #1429 | FormLift for Keap (Legacy) Web Forms | 30 | 162 | 315 | 400 | Request data is not unslashed | ||
| #1430 | Formzu WP | 30 | 167 | 163 | 3k+ | Text Domain Mismatch | ||
| #1431 | GlobalPayments Gateway Provider for WooCommerce | 30 | 640 | 172 | 1k+ | Text Domain Mismatch | ||
| #1432 | Kargo Takip, Kargo SMS, İlçe Mahalle Sözleşme by Hezarfen | 30 | 70 | 297 | 2k+ | Non-prefixed global variable | ||
| #1433 | Import WooCommerce Suite for Products, Orders, Coupons, Reviews, and Customers | WP Ultimate CSV Importer | 30 | 80 | 434 | 4k+ | Interpolated SQL is not prepared | ||
| #1434 | Invisible reCaptcha for WordPress | 30 | 90 | 185 | 80k+ | Input is not sanitized | ||
| #1435 | Jetpack Protect | 30 | 657 | 217 | 100k+ | Text Domain Mismatch | ||
| #1436 | core plugin for kitestudio themes | 30 | 244 | 415 | 500 | Nonce verification recommended | ||
| #1437 | Laposta Signup Embed | 30 | 88 | 19 | 1k+ | Exception output is not escaped | ||
| #1438 | Midtrans-WooCommerce | 30 | 112 | 132 | 5k+ | Non-prefixed global variable | ||
| #1439 | Move Addons for Elementor | 30 | 3,919 | 91 | 2k+ | Text Domain Mismatch | ||
| #1440 | Naver webmaster syndication v2 | 30 | 89 | 129 | 500 | Output is not escaped | ||
| #1441 | Novelist | 30 | 475 | 158 | 1k+ | Output is not escaped | ||
| #1442 | OoohBoi Steroids for Elementor | 30 | 2,059 | 100 | 40k+ | Text Domain Mismatch | ||
| #1443 | Operation Demo Importer – Demo Importer For WPoperation Themes | 30 | 245 | 104 | 1k+ | Text Domain Mismatch | ||
| #1444 | گرویتی فرم فارسی | 30 | 205 | 157 | 20k+ | Text Domain Mismatch | ||
| #1445 | PitchPrint | 30 | 76 | 163 | 400 | Input is not sanitized | ||
| #1446 | Popularis Extra | 30 | 237 | 141 | 7k+ | Output is not escaped | ||
| #1447 | Popup Builder – Create highly converting, mobile friendly marketing popups. | 30 | 28 | 722 | 200k+ | Non-prefixed global variable | ||
| #1448 | Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget | 30 | 231 | 102 | 1k+ | Non Singular String Literal Domain | ||
| #1449 | Pre-Orders for WooCommerce | 30 | 568 | 261 | 7k+ | Output is not escaped | ||
| #1450 | Sync Master Sheet – Product Sync with Google Sheet for WooCommerce | 30 | 136 | 300 | 400 | Non-prefixed global variable |
