PluginScore

WordPress.Security.NonceVerification.Recommended

Nonce verification recommended

The code reads request data in a place where Plugin Check recommends a nonce check.

critical weight

Why It Shows Up

The scan saw request handling that may not always mutate state, but still looks like a user-triggered action that should usually be protected by a nonce.

Why It Matters

Adding a nonce reduces accidental or forged requests and documents that the action is expected to originate from the plugin UI.

How to Fix

  • For admin forms and action links, add and verify a nonce.
  • For AJAX handlers, use `check_ajax_referer()`.
  • For public read-only endpoints, document why a nonce is not required and keep input validation strict.

References

WordPress nonces

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#2151Media Library Downloader3521164k+Output is not escaped
#2152MeetingHub – Webinar & Meeting Plugin for Zoom, Google Meet, Webex, Microsoft Teams, & Jitsi Meet3537313400Non-prefixed global variable
#2153Restaurant Menu – Food Ordering System – Table Reservation353171868k+Unsafe printing function
#2154Mighty Pros & Cons35126800Text Domain Mismatch
#2155Mini Ajax Cart for WooCommerce35297240900Text Domain Mismatch
#2156MONEI Payments for WooCommerce351565500Non-prefixed hook name
#2157mosparo Integration35114301900Missing nonce verification
#2158Never Let Me Go353447400Non-prefixed global variable
#2159NGG Smart Image Search35298155400Output is not escaped
#2160Nginx Cache Controller3579961k+Text Domain Mismatch
#2161Ni WooCommerce Sales Report35236256500Text Domain Mismatch
#2162Nooz35287108500Text Domain Mismatch
#2163Noted!355221k+Non-prefixed global variable
#2164One Page Express Companion351326510k+Output is not escaped
#2165ONet Regenerate Thumbnails35190641k+Text Domain Mismatch
#2166Plugin Ongkos Kirim JNE Tiki Sicepat Wahana J&T POS for Woocommerce351171442k+Output is not escaped
#2167Order Delivery Date for WooCommerce352,0757310k+wp function not compatible with requires wp
#2168Orderable – Restaurant & Food Ordering System35123245k+Non-prefixed global variable
#2169OSM Map Widget for Elementor35183149k+Text Domain Mismatch
#2170OT Flatsome Vertical Menu351262610k+Text Domain Mismatch
#2171Page Optimize357041200k+Non Singular String Literal Domain
#2172Paybox WooCommerce Payment Gateway3516588500Non Singular String Literal Domain
#2173Paytm Payment Gateway35921043k+Missing Arg Domain
#2174Paytrail for WooCommerce3528463k+Non-prefixed global variable
#2175Perfecty Push Notifications352042134k+SQL query is not prepared
#2176Pie Calendar – Events Calendar Made Simple3583531k+Text Domain Mismatch
#2177Planyo online reservation system356490400Output is not escaped
#2178Plausible Analytics352446110k+Exception output is not escaped
#2179Pochipp352710220k+Non-prefixed global variable
#2180Poptin – Email Marketing Automation, Newsletter & Exit Pop Ups, Email Popups351682920k+Output is not escaped
#2181Popup with fancybox35196168900Unsafe printing function
#2182Post Content Shortcodes35205562k+Output is not escaped
#2183Post Draft Preview354969700Text Domain Mismatch
#2184Post List Featured Image35112100900Output is not escaped
#2185Post Meta Data Manager35301121k+Non-prefixed global variable
#2186Post Password Token3513238600Text Domain Mismatch
#2187Posts Table with Search & Sort35143333k+Text Domain Mismatch
#2188Product Input Fields for WooCommerce3518844k+Non-prefixed function
#2189Min Max Step Quantity Limits Manager for WooCommerce35671583k+Non-prefixed global variable
#2190Protect the Children!352341k+Missing nonce verification
#2191Publitio354726400curl curl setopt
#2192Push Notifications by LaraPush3532765k+Non-prefixed global variable
#2193Push7354517700Short PHP open tag found
#2194Quran multilanguage Text & Audio35177166500Output is not escaped
#2195ReactPress – Create React App for WordPress3526433k+Request data is not unslashed
#2196Real Time Validation for Gravity Forms35185302k+Output is not escaped
#2197Really Simple Google Tag Manager (GTM)35115154k+Text Domain Mismatch
#2198Related Posts for WordPress3520718010k+Output is not escaped
#2199Remove Admin Toolbar35137600Missing direct file access protection
#2200Remove Dashboard Access35162330k+wp function not compatible with requires wp