WordPress.Security.NonceVerification.Recommended
Nonce verification recommended
The code reads request data in a place where Plugin Check recommends a nonce check.
Why It Shows Up
The scan saw request handling that may not always mutate state, but still looks like a user-triggered action that should usually be protected by a nonce.
Why It Matters
Adding a nonce reduces accidental or forged requests and documents that the action is expected to originate from the plugin UI.
How to Fix
- For admin forms and action links, add and verify a nonce.
- For AJAX handlers, use `check_ajax_referer()`.
- For public read-only endpoints, document why a nonce is not required and keep input validation strict.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #1551 | Post Pay Counter | 31 | 639 | 238 | 1k+ | Output is not escaped | ||
| #1552 | Product Configurator for WooCommerce | 31 | 41 | 562 | 3k+ | Non-prefixed hook name | ||
| #1553 | Active Products Tables for WooCommerce. Use constructor to create tables | 31 | 364 | 424 | 1k+ | Output is not escaped | ||
| #1554 | Push notification for Mobile and Web app | 31 | 87 | 83 | 400 | Non Singular String Literal Domain | ||
| #1555 | Qi Blocks | 31 | 46 | 345 | 60k+ | Non-prefixed global variable | ||
| #1556 | Query Monitor | 31 | 44 | 273 | 200k+ | Non-prefixed class | ||
| #1557 | Raffle Play Woocommerce | 31 | 151 | 199 | 800 | Output is not escaped | ||
| #1558 | Re:amaze Helpdesk & Live Chat | 31 | 96 | 115 | 400 | Output is not escaped | ||
| #1559 | Redirection | 31 | 39 | 323 | 2m+ | Direct Query | ||
| #1560 | Coming Soon Page & Maintenance Mode | 31 | 613 | 266 | 3k+ | Text Domain Mismatch | ||
| #1561 | Social Share Buttons | 31 | 462 | 156 | 1k+ | Text Domain Mismatch | ||
| #1562 | Sidebar Manager Light | 31 | 221 | 76 | 1k+ | Text Domain Mismatch | ||
| #1563 | Simple calendar for Elementor | 31 | 125 | 270 | 500 | Direct Query | ||
| #1564 | Smart Keywords Tool – 智能关键词插件 | 31 | 361 | 33 | 600 | Non Singular String Literal Domain | ||
| #1565 | SmartBill Facturare si Gestiune | 31 | 421 | 164 | 5k+ | Text Domain Mismatch | ||
| #1566 | SpeedyCache – Cache, Optimization, Performance | 31 | 65 | 118 | 600k+ | Input is not validated | ||
| #1567 | Staatic – Static Site Generator for WordPress | 31 | 420 | 195 | 2k+ | SQL query is not prepared | ||
| #1568 | Swatchly – Product Variation Swatches for WooCommerce | 31 | 540 | 214 | 5k+ | Output is not escaped | ||
| #1569 | WP Testimonials | 31 | 183 | 455 | 10k+ | Non-prefixed global variable | ||
| #1570 | Themify Store Locator | 31 | 244 | 125 | 500 | Text Domain Mismatch | ||
| #1571 | Tutor LMS Elementor Addons | 31 | 227 | 453 | 30k+ | Non-prefixed global variable | ||
| #1572 | User Spam Remover | 31 | 115 | 14 | 1k+ | Output is not escaped | ||
| #1573 | Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & Checkout Verification | 31 | 295 | 876 | 2k+ | Missing nonce verification | ||
| #1574 | Web Push Notifications – Webpushr | 31 | 169 | 293 | 10k+ | Output is not escaped | ||
| #1575 | Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets | 31 | 837 | 295 | 100k+ | Unsafe printing function | ||
| #1576 | Return Refund and Exchange For WooCommerce | 31 | 24 | 713 | 4k+ | Non-prefixed global variable | ||
| #1577 | WooCommerce Legacy REST API | 31 | 324 | 177 | 400k+ | Missing Translators Comment | ||
| #1578 | WCPOS – Point of Sale (POS) plugin for WooCommerce | 31 | 75 | 226 | 5k+ | Nonce verification recommended | ||
| #1579 | Tooltips for WordPress | 31 | 312 | 252 | 5k+ | Output is not escaped | ||
| #1580 | Worldline Global Online Pay for WooCommerce | 31 | 160 | 86 | 500 | Missing direct file access protection | ||
| #1581 | Discussion Board – WordPress Forum Plugin | 31 | 105 | 153 | 2k+ | Request data is not unslashed | ||
| #1582 | WPGatsby | 31 | 125 | 55 | 3k+ | Text Domain Mismatch | ||
| #1583 | WP Simple Booking Calendar | 31 | 337 | 380 | 20k+ | Output is not escaped | ||
| #1584 | WP Visitor Statistics (Real Time Traffic) | 31 | 353 | 691 | 20k+ | Nonce verification recommended | ||
| #1585 | WP ULike – Like & Dislike Buttons for Engagement and Feedback | 31 | 269 | 358 | 60k+ | Output is not escaped | ||
| #1586 | WP125 | 31 | 178 | 184 | 3k+ | Unsafe printing function | ||
| #1587 | One to one user Chat by WPGuppy | 31 | 74 | 187 | 700 | Non-prefixed global variable | ||
| #1588 | WPDoctor Malware Scanner & Vulnerability Checker & IP blocker with Hack monitor Lite | 31 | 133 | 438 | 600 | Non-prefixed global variable | ||
| #1589 | WPOrLogin – Custom Login, Social Login, Limit Attempts, Hide Login & reCAPTCHA | 31 | 483 | 217 | 2k+ | Unsafe printing function | ||
| #1590 | Dynamic XML Sitemaps Generator for Google | 31 | 75 | 417 | 20k+ | Non-prefixed global variable | ||
| #1591 | Zendesk Support for WordPress | 31 | 195 | 88 | 2k+ | Output is not escaped | ||
| #1592 | ACME Divi Modules | 32 | 573 | 35 | 400 | Text Domain Mismatch | ||
| #1593 | ActiveDEMAND | 32 | 157 | 161 | 1k+ | Output is not escaped | ||
| #1594 | Advanced Access Manager – Access Governance for WordPress | 32 | 849 | 62 | 100k+ | Output is not escaped | ||
| #1595 | Affiliate Coupons – Coupon Display Manager – Excellent Tool for Affiliate Marketers | 32 | 183 | 61 | 1k+ | Output is not escaped | ||
| #1596 | All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier | 32 | 325 | 102 | 600 | Missing Arg Domain | ||
| #1597 | annasta Filters for WooCommerce | 32 | 1,073 | 441 | 2k+ | Text Domain Mismatch | ||
| #1598 | Aqua Page Builder | 32 | 320 | 114 | 2k+ | Output is not escaped | ||
| #1599 | aThemes Blocks | 32 | 192 | 1,034 | 6k+ | Non-prefixed global variable | ||
| #1600 | Author Avatars List/Block | 32 | 85 | 135 | 4k+ | Non-prefixed hook name |
