WordPress.Security.NonceVerification.Recommended
Nonce verification recommended
The code reads request data in a place where Plugin Check recommends a nonce check.
Why It Shows Up
The scan saw request handling that may not always mutate state, but still looks like a user-triggered action that should usually be protected by a nonce.
Why It Matters
Adding a nonce reduces accidental or forged requests and documents that the action is expected to originate from the plugin UI.
How to Fix
- For admin forms and action links, add and verify a nonce.
- For AJAX handlers, use `check_ajax_referer()`.
- For public read-only endpoints, document why a nonce is not required and keep input validation strict.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #1651 | PilotPress | 32 | 150 | 285 | 900 | Output is not escaped | ||
| #1652 | TS Poll – Survey, Versus Poll, Image Poll, Video Poll | 32 | 570 | 171 | 4k+ | Text Domain Mismatch | ||
| #1653 | Post and Page Builder by BoldGrid – Visual Drag and Drop Editor | 32 | 348 | 258 | 50k+ | Output is not escaped | ||
| #1654 | Posti Shipping | 32 | 664 | 157 | 1k+ | Text Domain Mismatch | ||
| #1655 | Volunteer Sign Up Sheets | 32 | 967 | 401 | 1k+ | Output is not escaped | ||
| #1656 | Quick Featured Images | 32 | 436 | 323 | 50k+ | Non-prefixed global variable | ||
| #1657 | Responsive Filterable Portfolio Gallery – Media Grid & Video Portfolio | 32 | 436 | 163 | 1k+ | Output is not escaped | ||
| #1658 | Restrict Usernames Emails Characters | 32 | 327 | 367 | 1k+ | Output is not escaped | ||
| #1659 | WowRevenue – Product Bundles & Bulk Discounts | 32 | 13 | 2,027 | 1k+ | Non-prefixed global variable | ||
| #1660 | RSS for Yandex Turbo | 32 | 687 | 307 | 20k+ | Unsafe printing function | ||
| #1661 | Shariff Wrapper | 32 | 33 | 404 | 30k+ | Non-prefixed global variable | ||
| #1662 | Showcase IDX Real Estate Search & Lead Capture | 32 | 123 | 52 | 2k+ | Output is not escaped | ||
| #1663 | Simple Ajax Chat – Add a Fast, Secure Chat Box | 32 | 107 | 266 | 2k+ | Output is not escaped | ||
| #1664 | Site Search 360 | 32 | 202 | 213 | 400 | Output is not escaped | ||
| #1665 | Sky Addons for Elementor | 32 | 85 | 351 | 2k+ | Non-prefixed namespace | ||
| #1666 | Spoki – Chat Buttons and WooCommerce Notifications | 32 | 1,074 | 260 | 700 | Unsafe printing function | ||
| #1667 | Stock Locations for WooCommerce | 32 | 549 | 360 | 900 | Output is not escaped | ||
| #1668 | Stock Sync for WooCommerce | 32 | 362 | 232 | 1k+ | Text Domain Mismatch | ||
| #1669 | Subscribe2 – Form, Email Subscribers & Newsletters | 32 | 32 | 410 | 10k+ | Direct Query | ||
| #1670 | ووسلام – همگام سازی ووکامرس و باسلام | 32 | 92 | 426 | 4k+ | Non-prefixed global variable | ||
| #1671 | System Dashboard | 32 | 91 | 205 | 900 | Request data is not unslashed | ||
| #1672 | Tainacan Support for Blocksy | 32 | 244 | 526 | 500 | Non-prefixed global variable | ||
| #1673 | Theme My Login | 32 | 251 | 549 | 60k+ | Non-prefixed function | ||
| #1674 | Thrive Automator | 32 | 84 | 84 | 10k+ | SQL query is not prepared | ||
| #1675 | Tumult Hype Animations | 32 | 56 | 117 | 1k+ | Output is not escaped | ||
| #1676 | UiCore Blocks – Free WordPress Gutenberg Blocks | 32 | 59 | 394 | 500 | Non-prefixed global variable | ||
| #1677 | Ultimate Store Kit – Addon For WooCommerce, EDD and Elementor | 32 | 57 | 293 | 4k+ | Post Not In exclude | ||
| #1678 | Unbounce Landing Pages | 32 | 169 | 86 | 10k+ | Output is not escaped | ||
| #1679 | Secure Client Portal and Private File Sharing Plugin – User Private Files | 32 | 183 | 525 | 1k+ | Non-prefixed global variable | ||
| #1680 | User Registration Using Contact Form 7 | 32 | 103 | 15 | 500 | wp function not compatible with requires wp | ||
| #1681 | Multi Currency For WooCommerce | 32 | 87 | 70 | 1k+ | Non-prefixed global variable | ||
| #1682 | WebwinkelKeur: Webshop keurmerk & reviews for WordPress | 32 | 200 | 47 | 4k+ | Short PHP open tag found | ||
| #1683 | Management App for WooCommerce – Order notifications, Order management, Lead management, Uptime Monitoring | 32 | 196 | 160 | 900 | Text Domain Mismatch | ||
| #1684 | Easy 3D Viewer | 32 | 399 | 241 | 1k+ | Text Domain Mismatch | ||
| #1685 | BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net | 32 | 5 | 933 | 40k+ | Non-prefixed global variable | ||
| #1686 | Payment Gateway for Redsys & WooCommerce Lite | 32 | 125 | 75 | 20k+ | Text Domain Mismatch | ||
| #1687 | WooMS | 32 | 199 | 58 | 500 | Output is not escaped | ||
| #1688 | WP 2-step verification | 32 | 154 | 65 | 1k+ | Output is not escaped | ||
| #1689 | WP Bannerize Pro | 32 | 281 | 216 | 800 | Text Domain Mismatch | ||
| #1690 | WP fail2ban – Advanced Security | 32 | 75 | 153 | 60k+ | Dynamic hook name | ||
| #1691 | SEOPress – AI SEO Plugin & On-site SEO | 32 | 138 | 429 | 300k+ | Non-prefixed global variable | ||
| #1692 | WP-Stats | 32 | 237 | 126 | 2k+ | Output is not escaped | ||
| #1693 | WPCasa – Real Estate for WordPress | 32 | 85 | 429 | 1k+ | Non-prefixed global variable | ||
| #1694 | WT GeoTargeting | 32 | 89 | 43 | 1k+ | Output is not escaped | ||
| #1695 | Yoo Slider – Image Slider & Video Slider | 32 | 744 | 209 | 600 | Output is not escaped | ||
| #1696 | Advanced Coupons for WooCommerce Coupons & Store Credit | 33 | 84 | 215 | 20k+ | Non-prefixed global variable | ||
| #1697 | Advanced Forms for ACF | 33 | 169 | 278 | 3k+ | Non-prefixed hook name | ||
| #1698 | Agile CRM | 33 | 163 | 81 | 600 | wp function not compatible with requires wp | ||
| #1699 | AI WP Writer – SEO content generator, chatGPT, Gemini | 33 | 581 | 531 | 3k+ | Text Domain Mismatch | ||
| #1700 | App Builder – Create Native Android & iOS Apps On The Flight | 33 | 73 | 119 | 600 | Text Domain Mismatch |
