WordPress.Security.NonceVerification.Recommended
Nonce verification recommended
The code reads request data in a place where Plugin Check recommends a nonce check.
Why It Shows Up
The scan saw request handling that may not always mutate state, but still looks like a user-triggered action that should usually be protected by a nonce.
Why It Matters
Adding a nonce reduces accidental or forged requests and documents that the action is expected to originate from the plugin UI.
How to Fix
- For admin forms and action links, add and verify a nonce.
- For AJAX handlers, use `check_ajax_referer()`.
- For public read-only endpoints, document why a nonce is not required and keep input validation strict.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #1901 | Lenix Leads Collector | 34 | 414 | 242 | 10k+ | Text Domain Mismatch | ||
| #1902 | Login with Vipps and MobilePay | 34 | 263 | 174 | 900 | Output is not escaped | ||
| #1903 | Mailmunch Forms for Mailchimp | 34 | 120 | 53 | 10k+ | Output is not escaped | ||
| #1904 | MantraBrain Starter Sites | MantraBrain Theme Demo Importer | 34 | 117 | 61 | 1k+ | Output is not escaped | ||
| #1905 | Media Vault | 34 | 115 | 150 | 800 | Output is not escaped | ||
| #1906 | Melhor Envio | 34 | 24 | 276 | 10k+ | Nonce verification recommended | ||
| #1907 | Meow Analytics (Google Analytics) | 34 | 80 | 54 | 400 | Output is not escaped | ||
| #1908 | Meow Lightbox | 34 | 77 | 52 | 10k+ | Non Singular String Literal Domain | ||
| #1909 | Meta Tag Manager | 34 | 142 | 321 | 80k+ | Nonce verification recommended | ||
| #1910 | OTP Login & Register Woocommerce | 34 | 148 | 202 | 1k+ | Missing nonce verification | ||
| #1911 | Montonio for WooCommerce | 34 | 44 | 258 | 10k+ | Non-prefixed global variable | ||
| #1912 | mowomo Social Share | 34 | 202 | 156 | 1k+ | Output is not escaped | ||
| #1913 | MPL-Publisher — Ebook & Audiobook Creator | 34 | 489 | 76 | 800 | Text Domain Mismatch | ||
| #1914 | Multi Step Form | 34 | 277 | 139 | 9k+ | Output is not escaped | ||
| #1915 | My Tickets – Accessible Event Ticketing | 34 | 314 | 566 | 600 | Nonce verification recommended | ||
| #1916 | NextGEN Gallery Optimizer | 34 | 128 | 92 | 2k+ | Output is not escaped | ||
| #1917 | Ni WooCommerce Custom Order Status | 34 | 256 | 139 | 2k+ | Text Domain Mismatch | ||
| #1918 | One User Avatar | User Profile Picture | 34 | 68 | 190 | 100k+ | Non-prefixed global variable | ||
| #1919 | Optima Express IDX | 34 | 71 | 237 | 10k+ | Non-prefixed class | ||
| #1920 | Child Theme Creator by Orbisius | 34 | 86 | 39 | 10k+ | Output is not escaped | ||
| #1921 | Team Members Profile – Employee Directory & Staff Showcase | 34 | 339 | 90 | 600 | Output is not escaped | ||
| #1922 | OwnerRez | 34 | 79 | 56 | 700 | Unsafe printing function | ||
| #1923 | MW Font Changer | 34 | 463 | 75 | 7k+ | Text Domain Mismatch | ||
| #1924 | PDF Invoices and Packing Slips For WooCommerce | 34 | 108 | 284 | 1k+ | Non-prefixed global variable | ||
| #1925 | PhonePe Payment Solutions | 34 | 77 | 106 | 10k+ | Missing direct file access protection | ||
| #1926 | Podigee WordPress Quick Publish – now with Gutenberg support! | 34 | 108 | 95 | 700 | Text Domain Mismatch | ||
| #1927 | PushEngage – Web Push Notifications, WooCommerce Automation & Chat Widget | 34 | 46 | 298 | 9k+ | Missing nonce verification | ||
| #1928 | PW WooCommerce Gift Cards | 34 | 238 | 185 | 20k+ | Output is not escaped | ||
| #1929 | QuadLayers Telegram Button | 34 | 149 | 71 | 1k+ | Text Domain Mismatch | ||
| #1930 | Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers | 34 | 261 | 863 | 20k+ | Non-prefixed global variable | ||
| #1931 | Responsive Menu – Create Mobile-Friendly Menu | 34 | 68 | 40 | 70k+ | Nonce verification recommended | ||
| #1932 | RTMForm Builder | 34 | 188 | 209 | 30k+ | Text Domain Mismatch | ||
| #1933 | Route ‑ Shipping Protection | 34 | 64 | 150 | 500 | Missing nonce verification | ||
| #1934 | Saphali Woocommerce Lite | 34 | 376 | 313 | 10k+ | Non-prefixed global variable | ||
| #1935 | Search Meter | 34 | 191 | 94 | 20k+ | Output is not escaped | ||
| #1936 | Security Safe | 34 | 193 | 164 | 700 | Missing Translators Comment | ||
| #1937 | Seriously Simple Stats | 34 | 99 | 126 | 5k+ | Output is not escaped | ||
| #1938 | Shift8 CDN | 34 | 81 | 25 | 600 | Output is not escaped | ||
| #1939 | Student Result or Employee Database | 34 | 89 | 98 | 1k+ | Direct Query | ||
| #1940 | Social Integration for BlueSky | 34 | 98 | 147 | 700 | Non-prefixed global variable | ||
| #1941 | Software License Manager | 34 | 69 | 289 | 900 | Nonce verification recommended | ||
| #1942 | Subscribe to Download Lite – Email Before Download Plugin | 34 | 106 | 157 | 400 | Non-prefixed global variable | ||
| #1943 | SuperFrete | 34 | 84 | 242 | 1k+ | Request data is not unslashed | ||
| #1944 | Swiftype Site Search Plugin for WordPress | 34 | 250 | 50 | 400 | Output is not escaped | ||
| #1945 | Tab Ultimate | 34 | 107 | 138 | 1k+ | Output is not escaped | ||
| #1946 | TaxJar – Sales Tax Automation for WooCommerce | 34 | 236 | 170 | 5k+ | Text Domain Mismatch | ||
| #1947 | Testimonial Slider | 34 | 448 | 262 | 3k+ | Unsafe printing function | ||
| #1948 | Easy Mega Menu for WordPress – ThemeHunk | 34 | 480 | 256 | 1k+ | Text Domain Mismatch | ||
| #1949 | Tidio – Live Chat & AI Chatbots | 34 | 52 | 19 | 80k+ | curl curl setopt | ||
| #1950 | Tools for Twitter | 34 | 135 | 87 | 1k+ | Output is not escaped |
