WordPress.Security.NonceVerification.Recommended
Nonce verification recommended
The code reads request data in a place where Plugin Check recommends a nonce check.
Why It Shows Up
The scan saw request handling that may not always mutate state, but still looks like a user-triggered action that should usually be protected by a nonce.
Why It Matters
Adding a nonce reduces accidental or forged requests and documents that the action is expected to originate from the plugin UI.
How to Fix
- For admin forms and action links, add and verify a nonce.
- For AJAX handlers, use `check_ajax_referer()`.
- For public read-only endpoints, document why a nonce is not required and keep input validation strict.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #1801 | Variation Swatches for WooCommerce | 33 | 469 | 116 | 50k+ | Text Domain Mismatch | ||
| #1802 | Multi-Carrier EasyPost Shipping Methods & Address Validation for WooCommerce | 33 | 424 | 69 | 400 | Non Singular String Literal Domain | ||
| #1803 | Multi-Carrier Shippo Shipping Rates & Address Validation for WooCommerce | 33 | 411 | 73 | 3k+ | Non Singular String Literal Domain | ||
| #1804 | Webmention | 33 | 64 | 89 | 900 | Output is not escaped | ||
| #1805 | Website Monetization by MageNet | 33 | 60 | 87 | 20k+ | Output is not escaped | ||
| #1806 | Textmetrics | 33 | 324 | 163 | 400 | Output is not escaped | ||
| #1807 | White Label CMS | 33 | 412 | 202 | 200k+ | Unsafe printing function | ||
| #1808 | Rich Showcase for Google Reviews | 33 | 212 | 278 | 100k+ | Output is not escaped | ||
| #1809 | Wonder Slider Lite | 33 | 273 | 187 | 8k+ | Output is not escaped | ||
| #1810 | Product Addons for Woocommerce – Product Options with Custom Fields | 33 | 124 | 114 | 30k+ | Output is not escaped | ||
| #1811 | Min Max Control – Min Max Quantity & Step Control for WooCommerce | 33 | 96 | 215 | 10k+ | Non-prefixed global variable | ||
| #1812 | Hyyan WooCommerce Polylang Integration | 33 | 141 | 220 | 8k+ | Nonce verification recommended | ||
| #1813 | CartBounty – Save and recover abandoned carts for WooCommerce | 33 | 370 | 399 | 10k+ | Output is not escaped | ||
| #1814 | Pay. Payment Methods for WooCommerce | 33 | 318 | 104 | 3k+ | Non Singular String Literal Domain | ||
| #1815 | PDF Invoices Italian Add-on for WooCommerce | 33 | 325 | 200 | 4k+ | Non Singular String Literal Domain | ||
| #1816 | WOW Slider | 33 | 176 | 101 | 3k+ | Output is not escaped | ||
| #1817 | Books Gallery – Book Showcase, Library & Affiliate Plugin | 33 | 1,753 | 178 | 2k+ | Output is not escaped | ||
| #1818 | WP Edit | 33 | 337 | 137 | 40k+ | Unsafe printing function | ||
| #1819 | WP EXtra – One Click Optimize | 33 | 414 | 101 | 7k+ | Missing Arg Domain | ||
| #1820 | WP Social AutoConnect | 33 | 290 | 144 | 400 | Output is not escaped | ||
| #1821 | WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters | 33 | 220 | 453 | 60k+ | wp function not compatible with requires wp | ||
| #1822 | Connector for Gravity Forms and Google Sheets | 33 | 692 | 155 | 3k+ | Text Domain Mismatch | ||
| #1823 | EasyMedia – Increase Media Upload File Size | Role-Based Upload Limit | Increase Execution Time | 33 | 82 | 138 | 70k+ | Non-prefixed global variable | ||
| #1824 | WP Multilang – Translation and Multilingual Plugin | 33 | 53 | 118 | 10k+ | Database parameter is not escaped | ||
| #1825 | Paymattic – Secure, Simple Payment & Donation with Subscription Payments, Recurring Donations, Customer Management | 33 | 538 | 3k+ | Direct Query | |||
| #1826 | WP-UserOnline | 33 | 111 | 161 | 10k+ | Output is not escaped | ||
| #1827 | Editor Blocks by Download Manager | 33 | 174 | 102 | 5k+ | Output is not escaped | ||
| #1828 | WPoperation Elementor Addons | 33 | 891 | 52 | 1k+ | Text Domain Mismatch | ||
| #1829 | Video Gallery – YouTube Playlist, Channel Gallery by YotuWP | 33 | 278 | 101 | 20k+ | Missing Arg Domain | ||
| #1830 | Zita Site Library for Elementor | 33 | 107 | 135 | 1k+ | Text Domain Mismatch | ||
| #1831 | AFS Analytics | 34 | 194 | 98 | 600 | Text Domain Mismatch | ||
| #1832 | Advanced Shipping Validation for WooCommerce | 34 | 331 | 127 | 400 | Text Domain Mismatch | ||
| #1833 | Advanced Twenty Seventeen | 34 | 247 | 98 | 3k+ | Text Domain Mismatch | ||
| #1834 | Affilia – Affiliate Program | 34 | 80 | 170 | 500 | Nonce verification recommended | ||
| #1835 | AGCA – Custom Dashboard & Login Page | 34 | 350 | 44 | 20k+ | Unsafe printing function | ||
| #1836 | All In One Favicon | 34 | 214 | 62 | 60k+ | Output is not escaped | ||
| #1837 | All-in-One WP Migration and Backup | 34 | 47 | 69 | 5m+ | Missing nonce verification | ||
| #1838 | Arconix Shortcodes | 34 | 129 | 108 | 4k+ | Output is not escaped | ||
| #1839 | Assistant – Every Day Productivity Apps | 34 | 124 | 97 | 4k+ | Exception output is not escaped | ||
| #1840 | Audit Trail | 34 | 90 | 107 | 10k+ | Unsafe printing function | ||
| #1841 | Auto Listings – Car Listings & Car Dealership Plugin for WordPress | 34 | 80 | 318 | 2k+ | Non-prefixed global variable | ||
| #1842 | Automatic YouTube Gallery – Embed Auto-Updating YouTube Video Galleries, Feeds, Playlists & Channels | 34 | 86 | 255 | 9k+ | Direct Query | ||
| #1843 | AyeCode Connect | 34 | 178 | 253 | 10k+ | Nonce verification recommended | ||
| #1844 | Bayarcash WooCommerce | 34 | 148 | 138 | 700 | Non Singular String Literal Domain | ||
| #1845 | Beeketing for WooCommerce – Marketing Automation to Boost Sales | 34 | 113 | 123 | 600 | SQL query is not prepared | ||
| #1846 | BoldGrid Easy SEO – Simple and Effective SEO | 34 | 149 | 104 | 40k+ | Text Domain Mismatch | ||
| #1847 | Buckets | 34 | 68 | 76 | 500 | Output is not escaped | ||
| #1848 | BuddyPress & BuddyBoss Member Profile Forms | 34 | 154 | 121 | 400 | Text Domain Mismatch | ||
| #1849 | Cache Master | 34 | 371 | 27 | 400 | Output is not escaped | ||
| #1850 | Campi Moduli Italiani | 34 | 72 | 363 | 500 | Unquoted Complex Placeholder |
