PluginScore

WordPress.Security.NonceVerification.Recommended

Nonce verification recommended

The code reads request data in a place where Plugin Check recommends a nonce check.

critical weight

Why It Shows Up

The scan saw request handling that may not always mutate state, but still looks like a user-triggered action that should usually be protected by a nonce.

Why It Matters

Adding a nonce reduces accidental or forged requests and documents that the action is expected to originate from the plugin UI.

How to Fix

  • For admin forms and action links, add and verify a nonce.
  • For AJAX handlers, use `check_ajax_referer()`.
  • For public read-only endpoints, document why a nonce is not required and keep input validation strict.

References

WordPress nonces

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#2051Cryptex | E-Mail Address Protection356210900Output is not escaped
#2052CubeWP Framework35114714k+wp function not compatible with requires wp
#2053Cue by AudioTheme.com35281506k+Non-prefixed hook name
#2054Currency Switcher for WooCommerce3516661800Text Domain Mismatch
#2055Custom CSS and JavaScript35389110k+Input is not sanitized
#2056Custom JavaScript Editor35823400Missing Version
#2057Custom Order Numbers for WooCommerce3563220k+Non-prefixed hook name
#2058Custom Post Type Maker35240866k+Unsafe printing function
#2059Dadevarzan WordPress Common355671700Text Domain Mismatch
#2060DarkLooks – Dark Mode Switcher For WordPress3519521900Text Domain Mismatch
#2061Datafeedr Product Sets356022065k+Output is not escaped
#2062Deposits & Partial Payments for WooCommerce351741445k+Text Domain Mismatch
#2063Dintero Checkout for WooCommerce Payment Methods355848600Text Domain Mismatch
#2064PiWeb Disable payment method / Partial payment for WooCommerce35552214k+Non-prefixed class
#2065Disable and Remove Google Fonts | GDPR & DSGVO friendly352111100k+Missing Translators Comment
#2066Disable XML-RPC-API3544452100k+Text Domain Mismatch
#2067DOOFINDER Search and Discovery for WP & WooCommerce351511202k+Text Domain Mismatch
#2068Easy Dash for LearnDash3562388700Text Domain Mismatch
#2069Easy Noindex And Nofollow355518400Output is not escaped
#2070Easy Panorama3512010500Non Singular String Literal Domain
#2071Easy Post Types and Fields351381351k+Text Domain Mismatch
#2072Product Bundle Builder for WooCommerce351521386k+Text Domain Mismatch
#2073Easy Social Icons3518215820k+Output is not escaped
#2074Easy SwipeBox35157102k+Non Singular String Literal Domain
#2075Editorial Calendar3512716020k+Output is not escaped
#2076Elementor Website Builder – more than just a page builder354642810m+Non-prefixed global variable
#2077Email Subscription Popup — Newsletter & GDPR Consent356831931k+Output is not escaped
#2078Email Validator for Contact Form 73511174500SQL query is not prepared
#2079Embed Extended – Embed Maps, Videos, Websites, Source Codes, and more3510292400Non-prefixed global variable
#2080Enlighter – Customizable Syntax Highlighter35501010k+Output is not escaped
#2081EnvíaloSimple: Email Marketing y Newsletters351472502k+Nonce verification recommended
#2082Equivalent Mobile Redirect3529172k+Text Domain Mismatch
#2083Connect WooCommerce to ActiveCampaign by EqualServing35135891k+Text Domain Mismatch
#2084Ever Compare – Products Compare Plugin for WooCommerce35223600Non-prefixed global variable
#2085AI Popup Builder & Popup Maker by OptiMonk3581654k+Text Domain Mismatch
#2086Expire User Passwords353153k+Nonce verification recommended
#2087Export Featured Images35176671k+Output is not escaped
#2088External Links Overview3557200800Non-prefixed global variable
#2089F4 Shipping Phone and E-Mail for WooCommerce352130800Non-prefixed hook name
#2090WP2Social Auto Publish356432159k+Unsafe printing function
#2091Pixel Cat – Conversion Pixel Manager3525321540k+Output is not escaped
#2092Instant Indexing for Google351362200k+Non-prefixed global variable
#2093Reviews Widgets for Google, TripAdvisor, Yelp & Recommendations3525522510k+Output is not escaped
#2094Flexible Checkout Fields for WooCommerce – WooCommerce Checkout Manager35646480k+Non-prefixed global variable
#2095Flexible PDF Coupons – Gift Cards & Vouchers for WooCommerce358202k+Non-prefixed global variable
#2096Flexible PDF Invoices for WooCommerce & WordPress3515556k+Non-prefixed global variable
#2097Flexible Subscriptions35462491k+Non-prefixed global variable
#2098Flying Analytics: Self-Host Google Analytics v4 with Speed Optimization3517134k+Missing direct file access protection
#2099Events Calendar by FooEvents3557594k+Non-prefixed global variable
#2100FooGallery Migrate35412321k+Non-prefixed global variable