PluginScore

WordPress.Security.NonceVerification.Recommended

Nonce verification recommended

The code reads request data in a place where Plugin Check recommends a nonce check.

critical weight

Why It Shows Up

The scan saw request handling that may not always mutate state, but still looks like a user-triggered action that should usually be protected by a nonce.

Why It Matters

Adding a nonce reduces accidental or forged requests and documents that the action is expected to originate from the plugin UI.

How to Fix

  • For admin forms and action links, add and verify a nonce.
  • For AJAX handlers, use `check_ajax_referer()`.
  • For public read-only endpoints, document why a nonce is not required and keep input validation strict.

References

WordPress nonces

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#101Paysera Payment Gateway for WooCommerce211,8661957k+Exception output is not escaped
#102WooCommerce211,3596,1727m+Non-prefixed global variable
#103Pay For Post with WooCommerce219601,4741k+Non-prefixed global variable
#104PPOM – Product Addons & Custom Fields for WooCommerce213361,32220k+Non-prefixed global variable
#105Wordfence Security – Firewall, Malware Scan, and Login Security211,5922,9735m+Output is not escaped
#106WP Compress – Instant Performance & Speed Optimization213,3493,21810k+Non Singular String Literal Domain
#107WP-Lister Lite for eBay216,6975,1292k+Output is not escaped
#108WP phpMyAdmin214,5286,43550k+Missing Arg Domain
#109wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin211,8111,43270k+Output is not escaped
#110Premium Packages – Sell Digital Products Securely212,7652,4443k+Output is not escaped
#111WPScan – WordPress Security Scanner215272658k+Text Domain Mismatch
#112Frontend Admin by DynamiApps225,9223,20810k+Text Domain Mismatch
#113Advanced Classifieds & Directory Pro221,2293,5112k+Non-prefixed global variable
#114Advanced Form Integration — Connect Forms to 200+ Apps225,7714,67810k+wp function not compatible with requires wp
#115Ajax Load More – Infinite Scroll, Load More, & Lazy Load2264159540k+Unsafe printing function
#116All-in-One Video Gallery229112,89220k+Non-prefixed global variable
#117Booking for Appointments and Events Calendar – Amelia221,48948090k+Exception output is not escaped
#118Shortcodes and extra features for Phlox theme2241342690k+Output is not escaped
#119Knowledge Base documentation & wiki plugin – BasePress Docs226711,7672k+Non-prefixed global variable
#120Borderless – Addons and Templates for Elementor224381,3885k+Non-prefixed global variable
#121Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots221,6042,01910k+Direct Query
#122BuddyPress225839,008100k+Non-prefixed function
#123Better WordPress Minify224124848k+Non Singular String Literal Domain
#124Captcha by BestWebSoft – Advanced Spam Protection, Math & OCR-Friendly Captcha for Site Forms2249329510k+Text Domain Mismatch
#125Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer222,8581,27050k+Text Domain Mismatch
#126Code Profiler – WordPress Performance Profiling and Debugging Made Easy222654008k+Non-prefixed global variable
#127Passster – Password Protect Pages and Content225391,41910k+Non-prefixed global variable
#128RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login223,6545,0618k+Non-prefixed global variable
#129WP Customer Area223,30894110k+Text Domain Mismatch
#130SysBasics Customize My Account for WooCommerce – Dashboard, Endpoints, Avatar & Menu Manager227468528k+Non-prefixed global variable
#131Data Tables Generator by Supsystic2215715010k+Exception output is not escaped
#132Directorist: AI-Powered Business Directory, Listings & Classified Ads224432,12920k+Non-prefixed global variable
#133Download Manager222,2901,301100k+Output is not escaped
#134Dynamic QR Code – generator222382086k+Missing direct file access protection
#135E2Pdf – Export Pdf Tool for WordPress221,07583610k+Unsafe printing function
#136Easy Social Feed – Social Photos Gallery and Post Feed for WordPress221,5671,27730k+Non-prefixed global variable
#137EleSpare – News, Magazine and Blog Addons for Elementor227331,42310k+Non-prefixed global variable
#138Estatik Real Estate Plugin223,04932510k+Text Domain Mismatch
#139Events Manager – Calendar, Bookings, Tickets, and more!224,7225,62170k+Output is not escaped
#140Falang multilanguage for WordPress227167691k+Output is not escaped
#141File Manager Pro – Filester22565391100k+Request data is not unslashed
#142Finale Lite – Sales Countdown Timer & Discount for WooCommerce221,0314514k+Output is not escaped
#143FireBox Popups – Increase Sales and Grow Your Email List221538127k+Non-prefixed global variable
#144Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder22409236700k+Text Domain Mismatch
#145Notification Bar, Announcement and Cookie Notice WordPress Plugin – FooBar221,3211,3713k+Non-prefixed global variable
#146Five Star Restaurant Menu and Food Ordering227526095k+Output is not escaped
#147GeoDirectory – WP Business Directory Plugin and Classified Listings Directory224,4663,97210k+Output is not escaped
#148Anti-Malware Security and Brute-Force Firewall22544965100k+Output is not escaped
#149Gutenberg22628342300k+Missing direct file access protection
#150Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms221,03772220k+Unsafe printing function