WordPress.Security.NonceVerification.Recommended
Nonce verification recommended
The code reads request data in a place where Plugin Check recommends a nonce check.
Why It Shows Up
The scan saw request handling that may not always mutate state, but still looks like a user-triggered action that should usually be protected by a nonce.
Why It Matters
Adding a nonce reduces accidental or forged requests and documents that the action is expected to originate from the plugin UI.
How to Fix
- For admin forms and action links, add and verify a nonce.
- For AJAX handlers, use `check_ajax_referer()`.
- For public read-only endpoints, document why a nonce is not required and keep input validation strict.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #1451 | Pubjet | پابجت | 30 | 91 | 172 | 1k+ | Output is not escaped | ||
| #1452 | QA Assistants – Driven by data | 30 | 4 | 867 | 2k+ | Non-prefixed global variable | ||
| #1453 | Real Cookie Banner: GDPR & ePrivacy Cookie Consent | 30 | 9 | 496 | 100k+ | Database parameter is not escaped | ||
| #1454 | Responsive Addons for Elementor – Free Elementor Addons, Kits and Elementor Templates | 30 | 60 | 387 | 3k+ | Non-prefixed global variable | ||
| #1455 | Rublon Multi-Factor Authentication (MFA) | 30 | 216 | 160 | 400 | Output is not escaped | ||
| #1456 | Rank Math SEO – AI SEO Tools to Dominate SEO Rankings | 30 | 45 | 374 | 4m+ | Non-prefixed global variable | ||
| #1457 | StoreBuild – Online Store Builder for WooCommerce | 30 | 120 | 211 | 600 | Non-prefixed global variable | ||
| #1458 | Sina Extension for Elementor | 30 | 3,691 | 160 | 40k+ | Text Domain Mismatch | ||
| #1459 | Stackable – Page Builder Gutenberg Blocks | 30 | 482 | 87 | 100k+ | Non Singular String Literal Domain | ||
| #1460 | Star Addons for Elementor | 30 | 236 | 255 | 1k+ | Non-prefixed global variable | ||
| #1461 | Subscriptions for WooCommerce | 30 | 1 | 1,190 | 10k+ | Non-prefixed global variable | ||
| #1462 | Themify Portfolio Post | 30 | 214 | 102 | 30k+ | Text Domain Mismatch | ||
| #1463 | Travel Booking Toolkit | 30 | 245 | 324 | 3k+ | Non-prefixed global variable | ||
| #1464 | Tutor LMS Divi Modules | 30 | 420 | 722 | 1k+ | Non-prefixed global variable | ||
| #1465 | Urvanov Syntax Highlighter | 30 | 221 | 87 | 3k+ | Output is not escaped | ||
| #1466 | User Access Manager | 30 | 393 | 171 | 10k+ | Output is not escaped | ||
| #1467 | User Avatar – Reloaded | 30 | 352 | 171 | 900 | Text Domain Mismatch | ||
| #1468 | User Role by BestWebSoft – Add and Customize Roles and Capabilities in WordPress | 30 | 486 | 278 | 3k+ | Text Domain Mismatch | ||
| #1469 | Waitlist Woocommerce ( Back in stock notifier ) | 30 | 272 | 311 | 4k+ | Output is not escaped | ||
| #1470 | Checkout with Cash App on WooCommerce | 30 | 122 | 308 | 2k+ | Non-prefixed global variable | ||
| #1471 | Dropify | 30 | 132 | 254 | 2k+ | Nonce verification recommended | ||
| #1472 | Custom Post Types and Custom Fields creator – WCK | 30 | 1,299 | 137 | 10k+ | Text Domain Mismatch | ||
| #1473 | Webling | 30 | 147 | 313 | 500 | Input is not validated | ||
| #1474 | Widget Manager Light | 30 | 233 | 83 | 600 | Text Domain Mismatch | ||
| #1475 | Widgetize Pages Light | 30 | 145 | 104 | 3k+ | Output is not escaped | ||
| #1476 | WonderPush – Web Push Notifications – WooCommerce Abandoned Cart – GDPR | 30 | 152 | 192 | 600 | Missing direct file access protection | ||
| #1477 | FOX – Currency Switcher Professional for WooCommerce | 30 | 211 | 1,022 | 50k+ | Non-prefixed global variable | ||
| #1478 | Mercado Pago payments for WooCommerce | 30 | 619 | 63 | 100k+ | Short PHP open tag found | ||
| #1479 | WooCommerce Tax (formerly WooCommerce Shipping & Tax) | 30 | 103 | 198 | 600k+ | Non-prefixed class | ||
| #1480 | WP Admin UI Customize | 30 | 629 | 390 | 30k+ | Non-prefixed global variable | ||
| #1481 | WP Docs | 30 | 268 | 271 | 1k+ | Output is not escaped | ||
| #1482 | remarketable | 30 | 281 | 93 | 600 | Output is not escaped | ||
| #1483 | WP Inventory Manager | 30 | 856 | 233 | 1k+ | Output is not escaped | ||
| #1484 | WP Mail SMTP by WPForms – The Most Popular SMTP and Email Log Plugin | 30 | 32 | 346 | 4m+ | Non-prefixed hook name | ||
| #1485 | Photo Gallery Slideshow & Masonry Tiled Gallery | 30 | 806 | 352 | 1k+ | Output is not escaped | ||
| #1486 | WP Restaurant Price List | 30 | 295 | 95 | 500 | Text Domain Mismatch | ||
| #1487 | WPS Cleaner | 30 | 430 | 491 | 20k+ | Output is not escaped | ||
| #1488 | Yaad Sarig Payment Gateway For WC | 30 | 158 | 271 | 2k+ | Nonce verification recommended | ||
| #1489 | YASR – Yet Another Star Rating Plugin for WordPress | 30 | 252 | 378 | 10k+ | Output is not escaped | ||
| #1490 | zahls.ch Credit Cards, PostFinance and TWINT for WooCommerce | 30 | 121 | 265 | 3k+ | Non-prefixed global variable | ||
| #1491 | Zoho CRM Lead Magnet | 30 | 101 | 1,025 | 3k+ | Request data is not unslashed | ||
| #1492 | a3 Lazy Load | 31 | 83 | 239 | 90k+ | Dynamic hook name | ||
| #1493 | ActiveCampaign – The autonomous marketing platform | 31 | 235 | 98 | 40k+ | Output is not escaped | ||
| #1494 | AEH Speed Optimization: Browser Cache, Optimized Minify, Lazy Loading & Image Optimization | 31 | 91 | 133 | 2k+ | Output is not escaped | ||
| #1495 | Extra Product Options Builder for WooCommerce | 31 | 113 | 194 | 2k+ | Non-prefixed global variable | ||
| #1496 | Advanced Category Excluder | 31 | 349 | 160 | 700 | Output is not escaped | ||
| #1497 | Advanced Woo Search – Product Search for WooCommerce | 31 | 229 | 377 | 70k+ | Nonce verification recommended | ||
| #1498 | AI Builder – Generate pages, blocks, images & translate with AI | 31 | 101 | 194 | 400 | Non-prefixed global variable | ||
| #1499 | Titan Anti-spam & Security – Brute Force Protection, 2FA & Spam Filter | 31 | 57 | 196 | 50k+ | Nonce verification recommended | ||
| #1500 | Apaczka.pl WooCommerce | 31 | 99 | 276 | 1k+ | Non-prefixed global variable |
