WordPress.Security.NonceVerification.Recommended
Nonce verification recommended
The code reads request data in a place where Plugin Check recommends a nonce check.
Why It Shows Up
The scan saw request handling that may not always mutate state, but still looks like a user-triggered action that should usually be protected by a nonce.
Why It Matters
Adding a nonce reduces accidental or forged requests and documents that the action is expected to originate from the plugin UI.
How to Fix
- For admin forms and action links, add and verify a nonce.
- For AJAX handlers, use `check_ajax_referer()`.
- For public read-only endpoints, document why a nonce is not required and keep input validation strict.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #1851 | Campi Moduli Italiani | 34 | 72 | 363 | 500 | Unquoted Complex Placeholder | ||
| #1852 | SMS Abandoned Cart Recovery ✦ CartBoss | 34 | 67 | 72 | 400 | SQL query is not prepared | ||
| #1853 | Checkout Field Editor for WooCommerce – Checkout Manager | 34 | 122 | 64 | 20k+ | Text Domain Mismatch | ||
| #1854 | Clean Testimonials | 34 | 127 | 87 | 400 | Output is not escaped | ||
| #1855 | CM Search And Replace – Optimize content edits with a powerful search and replace tool | 34 | 286 | 111 | 2k+ | Output is not escaped | ||
| #1856 | Contact Form 7 – PayPal & Stripe Add-on | 34 | 93 | 233 | 7k+ | Exception output is not escaped | ||
| #1857 | Cornerstone | 34 | 161 | 174 | 30k+ | Nonce verification recommended | ||
| #1858 | CSS JS Manager, Async JavaScript, Defer Render Blocking CSS | 34 | 76 | 106 | 1k+ | Input is not validated | ||
| #1859 | Custom Login Page by SeedProd | 34 | 330 | 125 | 500 | Output is not escaped | ||
| #1860 | Custom Sidebars – Dynamic Sidebar Classic Widget Area Manager | 34 | 32 | 307 | 100k+ | Non-prefixed global variable | ||
| #1861 | Datafeedr API | 34 | 307 | 48 | 6k+ | Output is not escaped | ||
| #1862 | Debug Log Manager Tool | 34 | 44 | 143 | 3k+ | Nonce verification recommended | ||
| #1863 | Document Library Lite | 34 | 149 | 85 | 4k+ | Text Domain Mismatch | ||
| #1864 | Download After Email – Subscribe & Download Form Plugin | 34 | 22 | 356 | 7k+ | Input is not validated | ||
| #1865 | Delisho – Recipe Widgets and Blocks | 34 | 60 | 355 | 1k+ | Input is not sanitized | ||
| #1866 | EasyIndex | 34 | 74 | 135 | 1k+ | Missing nonce verification | ||
| #1867 | Einsatzverwaltung | 34 | 152 | 128 | 1k+ | Output is not escaped | ||
| #1868 | ECS – Ele Custom Skin for Elementor | 34 | 99 | 205 | 100k+ | Text Domain Mismatch | ||
| #1869 | ePayco Plugin for WooCommerce | 34 | 155 | 136 | 3k+ | Text Domain Mismatch | ||
| #1870 | Essential Classy Addons for Elementor – 150+ Widgets, Templates & Performance Tools | 34 | 283 | 186 | 500 | Output is not escaped | ||
| #1871 | Estimated Delivery for WooCommerce | 34 | 301 | 70 | 1k+ | Short PHP open tag found | ||
| #1872 | Event Calendar Newsletter | 34 | 96 | 167 | 600 | Non-prefixed hook name | ||
| #1873 | Event Post | 34 | 329 | 99 | 1k+ | Output is not escaped | ||
| #1874 | Export Customers Data | 34 | 109 | 49 | 500 | Text Domain Mismatch | ||
| #1875 | Social LikeBox & Feed | 34 | 393 | 141 | 10k+ | Non Singular String Literal Domain | ||
| #1876 | Profile Box Shortcode And Widget | 34 | 488 | 138 | 1k+ | Output is not escaped | ||
| #1877 | Fancy Comments WordPress | 34 | 359 | 39 | 2k+ | Unsafe printing function | ||
| #1878 | Featured Video Plus | 34 | 99 | 105 | 10k+ | Non-prefixed global variable | ||
| #1879 | Flash Toolkit | 34 | 158 | 242 | 10k+ | Non-prefixed global variable | ||
| #1880 | Weight Based Shipping Table Rate for WooCommerce – Flexible Shipping | 34 | 124 | 156 | 100k+ | Nonce verification recommended | ||
| #1881 | Floating Side Tab | 34 | 94 | 153 | 600 | Non-prefixed global variable | ||
| #1882 | FluentAuth – The Ultimate Authorization & Security Plugin for WordPress | 34 | 44 | 229 | 10k+ | Nonce verification recommended | ||
| #1883 | Forms: 3rd-Party Integration | 34 | 234 | 112 | 5k+ | Output is not escaped | ||
| #1884 | Garden Gnome Package | 34 | 116 | 51 | 4k+ | Text Domain Mismatch | ||
| #1885 | Geliver Akıllı Kargo Pazaryeri | 34 | 49 | 247 | 400 | Non-prefixed global variable | ||
| #1886 | Geolocation IP Detection | 34 | 227 | 167 | 20k+ | Output is not escaped | ||
| #1887 | Gitium | 34 | 149 | 57 | 400 | Output is not escaped | ||
| #1888 | Gratisfaction- Loyalty, Rewards , Referral, Birthday and Giveaway Program | 34 | 131 | 352 | 600 | Missing nonce verification | ||
| #1889 | Signature Add-On for Gravity Forms | 34 | 161 | 48 | 1k+ | Text Domain Mismatch | ||
| #1890 | Greenshift – animation and page builder blocks | 34 | 33 | 273 | 70k+ | Non-prefixed global variable | ||
| #1891 | Hide Price Until Login | 34 | 187 | 115 | 2k+ | Non Singular String Literal Domain | ||
| #1892 | Hippoo Mobile App for WooCommerce | 34 | 27 | 204 | 1k+ | Direct Query | ||
| #1893 | Hitsteps Web Analytics | 34 | 370 | 313 | 800 | Output is not escaped | ||
| #1894 | HollerBox — Fast & Effective Popups & Lead-Generation | 34 | 78 | 92 | 2k+ | Output is not escaped | ||
| #1895 | SSL Mixed Content Fix | 34 | 53 | 65 | 8k+ | Output is not escaped | ||
| #1896 | 우커머스 포트원 플러그인 (국내 모든 PG를 한 번에) | 34 | 36 | 181 | 600 | Nonce verification recommended | ||
| #1897 | Image Cleanup | 34 | 52 | 94 | 1k+ | Nonce verification recommended | ||
| #1898 | Import XML and RSS Feeds | 34 | 260 | 85 | 2k+ | Unsafe printing function | ||
| #1899 | Inavii Social Feed – Live Social Proof Gallery | 34 | 532 | 180 | 9k+ | Text Domain Mismatch | ||
| #1900 | IP2Location Country Blocker | 34 | 295 | 88 | 30k+ | Output is not escaped |
