PluginScore

WordPress.Security.NonceVerification.Recommended

Nonce verification recommended

The code reads request data in a place where Plugin Check recommends a nonce check.

critical weight

Why It Shows Up

The scan saw request handling that may not always mutate state, but still looks like a user-triggered action that should usually be protected by a nonce.

Why It Matters

Adding a nonce reduces accidental or forged requests and documents that the action is expected to originate from the plugin UI.

How to Fix

  • For admin forms and action links, add and verify a nonce.
  • For AJAX handlers, use `check_ajax_referer()`.
  • For public read-only endpoints, document why a nonce is not required and keep input validation strict.

References

WordPress nonces

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#151EleSpare – News, Magazine and Blog Addons for Elementor227331,42310k+Non-prefixed global variable
#152Estatik Real Estate Plugin223,04932510k+Text Domain Mismatch
#153Events Maker by dFactory225888191k+Output is not escaped
#154Events Manager – Calendar, Bookings, Tickets, and more!224,7225,62170k+Output is not escaped
#155Falang multilanguage for WordPress227167691k+Output is not escaped
#156File Manager Pro – Filester22565391100k+Request data is not unslashed
#157Finale Lite – Sales Countdown Timer & Discount for WooCommerce221,0314514k+Output is not escaped
#158FireBox Popups – Increase Sales and Grow Your Email List221538127k+Non-prefixed global variable
#159Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder22409236700k+Text Domain Mismatch
#160Notification Bar, Announcement and Cookie Notice WordPress Plugin – FooBar221,3211,3713k+Non-prefixed global variable
#161Five Star Restaurant Menu and Food Ordering227526095k+Output is not escaped
#162GeoDirectory – WP Business Directory Plugin and Classified Listings Directory224,4663,97210k+Output is not escaped
#163Anti-Malware Security and Brute-Force Firewall22544965100k+Output is not escaped
#164Gutenberg22628342300k+Missing direct file access protection
#165Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms221,03772220k+Unsafe printing function
#166HeadSpace2 SEO229403603k+Text Domain Mismatch
#167Csomagpontok és Címkék WooCommerce-hez222,0017697k+Text Domain Mismatch
#168IMPress for IDX Broker221,0856367k+Text Domain Mismatch
#169Insert or Embed Articulate Content into WordPress226591,4372k+Non-prefixed global variable
#170Számlázz.hu integráció WooCommerce-hez221,1694607k+Text Domain Mismatch
#171InfiniteWP Client222,2861,812200k+Exception output is not escaped
#172Import WP – Export and Import CSV and XML files to WordPress225803304k+Exception output is not escaped
#173LearnPress – WordPress LMS Plugin for Create and Sell Online Courses222,3613,38470k+Non-prefixed global variable
#174Leyka222533,4452k+Request data is not unslashed
#175Custom Login Page Customizer – Login Designer225881,45530k+Non-prefixed global variable
#176MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.222,6192,45310k+Output is not escaped
#177Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider22207323500k+Non-prefixed global variable
#178Modula Image Gallery – Photo Grid & Video Gallery22474436100k+Text Domain Mismatch
#179Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress229191,23010k+Output is not escaped
#180Moloni229023562k+Missing Arg Domain
#181Motors – Car Dealership & Classified Listings Plugin225,3405,9589k+Text Domain Mismatch
#182Newsletters222,9682,2482k+Text Domain Mismatch
#183NinjaFirewall (WP Edition) – Advanced Security Plugin and Firewall221,2652,065100k+Non-prefixed global variable
#184NinjaScanner – Virus & Malware scan2259655130k+Non-prefixed global variable
#185WP OAuth Server (OAuth Authentication)221893473k+Non-prefixed function
#186oik224891802k+Non Singular String Literal Domain
#187PagBank / PagSeguro Connect para WooCommerce225047434k+Non-prefixed global variable
#188PAYCOMET for WooCommerce221,2064232k+Text Domain Mismatch
#189Smart Popup by Supsystic223,17250310k+Non Singular String Literal Domain
#190Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App221,5812,326300k+Non-prefixed global variable
#191Prime Mover – Migrate WordPress Website & Backups221,3261,60010k+Non-prefixed global variable
#192Product Catalog Feed by PixelYourSite225813578k+Output is not escaped
#193PageSpeed Ninja – Cache, Minify, Defer CSS JavaScript, Critical CSS, Optimize Images, Convert WebP229844075k+Unsafe printing function
#194Quick Contact Form222606231k+Non-prefixed function
#195RabbitLoader Cache: Optimize your Website for Speed222411632k+Output is not escaped
#196Request a Quote Form Plugin – Price Quote Request Management Made Easy222411,1091k+Non-prefixed hook name
#197Restrict User Access – Ultimate Membership & Content Protection229771,84010k+Non-prefixed global variable
#198SALESmanago & Leadoo226454291k+Unsafe printing function
#199Salon Booking System – Free Version226506192k+Missing direct file access protection
#200Social Sharing Plugin – Sassy Social Share221,689233100k+wp function not compatible with requires wp