PluginScore

WordPress.Security.NonceVerification.Recommended

Nonce verification recommended

The code reads request data in a place where Plugin Check recommends a nonce check.

critical weight

Why It Shows Up

The scan saw request handling that may not always mutate state, but still looks like a user-triggered action that should usually be protected by a nonce.

Why It Matters

Adding a nonce reduces accidental or forged requests and documents that the action is expected to originate from the plugin UI.

How to Fix

  • For admin forms and action links, add and verify a nonce.
  • For AJAX handlers, use `check_ajax_referer()`.
  • For public read-only endpoints, document why a nonce is not required and keep input validation strict.

References

WordPress nonces

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#1751MailUp for WordPress – Email and Newsletter Subscription Form332511002k+Text Domain Mismatch
#1752MWB HubSpot for WooCommerce – CRM, Abandoned Cart, Email Marketing, Marketing Automation & Analytics33262797k+Non-prefixed global variable
#1753MAS Companies For WP Job Manager33623081k+Non-prefixed hook name
#1754MaxiBlocks Builder | 17,000+ Design Assets, Patterns, Icons & Starter Sites332503700Non-prefixed function
#1755Membership For WooCommerce3340659900Non-prefixed global variable
#1756Merge + Minify + Refresh3378264k+date date
#1757Molongui Post Contributors: Multi-Role Contributor Attribution33240162500Output is not escaped
#1758More Types33227198800Non-prefixed global variable
#1759Newebpay Payment33146115600Text Domain Mismatch
#1760News Announcement Scroll332372592k+Non-prefixed global variable
#1761Nomad World Map33424191700Text Domain Mismatch
#1762Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More332932151k+Text Domain Mismatch
#1763Payflex Payment Gateway33181611k+Text Domain Mismatch
#1764Payoneer Checkout33168455k+Exception output is not escaped
#1765PeproDev WooCommerce Receipt Uploader33325491k+Non Singular String Literal Domain
#1766PiWeb Delivery & Pickup Date Time for WooCommerce33397185500Text Domain Mismatch
#1767پینوا | Pinova3317175600Output is not escaped
#1768Plugin Organizer3332525710k+Output is not escaped
#1769FancyPost – Post Blocks, Grids & Sliders for Block Editor and Elementor33356271500Output is not escaped
#1770Post Lists View Custom334621502k+Missing Arg Domain
#1771PublishPress Checklists: Pre-Publishing Approval Checklist – Validate Post Requirements331401823k+Missing Translators Comment
#1772QNAP NAS Backup33374702k+Non Singular String Literal Domain
#1773Quick Restaurant Reservations33654179500Text Domain Mismatch
#1774Frisbii Pay33912921k+Non-prefixed global variable
#1775Rename wp-login.php to anything you want33251117500Output is not escaped
#1776Review Slider for WooCommerce33160422400Non-prefixed global variable
#1777Reviews Plus332233781k+Non-prefixed function
#1778RTMKit331138850k+Non-prefixed global variable
#1779RSS Feed Pro3348416500Output is not escaped
#1780Live Sales Notification (Recent Sales Popups)33114120400SQL query is not prepared
#1781Save as PDF Plugin by PDFCrowd332992541k+Non-prefixed global variable
#1782Schema & Structured Data for WP & AMP3363246100k+Non-prefixed global variable
#1783ShopPress – Shop Builder for Elementor and WooCommerce3311879500Non-prefixed global variable
#1784TaxCloud for WooCommerce3323261500Non-prefixed function
#1785Slider Path for Elementor33329100700Text Domain Mismatch
#1786SMTP2GO for WordPress – Email Made Easy3318611130k+Output is not escaped
#1787Social Rocket – Social Sharing Plugin331,0162551k+Unsafe printing function
#1788Spiffy Calendar334732433k+Output is not escaped
#1789Spin Wheel – Interactive spinning wheel that offers coupons33680313400Unsafe printing function
#1790Split Test For Elementor33981343k+Non-prefixed global variable
#1791Gravity Booster – Styles & Layouts for Gravity Forms332778740k+Missing Arg Domain
#1792Sublanguage33266287700Output is not escaped
#1793Telegram Bot & Channel33182113600Unsafe printing function
#1794Testimonial Slider – Free Testimonials Slider Plugin339150700Request data is not unslashed
#1795TP Education33186303800Unsafe printing function
#1796TrackingMore Order Tracking for WooCommerce (Free plan available)3394124700Text Domain Mismatch
#1797WP Twitter Auto Publish334421714k+Output is not escaped
#1798Uix Shortcodes33246444400Non-prefixed global variable
#1799Display Posts As List, Grid, Thumbs33442241900Output is not escaped
#1800Variation Swatches for WooCommerce3346911650k+Text Domain Mismatch