WordPress.Security.NonceVerification.Recommended
Nonce verification recommended
The code reads request data in a place where Plugin Check recommends a nonce check.
Why It Shows Up
The scan saw request handling that may not always mutate state, but still looks like a user-triggered action that should usually be protected by a nonce.
Why It Matters
Adding a nonce reduces accidental or forged requests and documents that the action is expected to originate from the plugin UI.
How to Fix
- For admin forms and action links, add and verify a nonce.
- For AJAX handlers, use `check_ajax_referer()`.
- For public read-only endpoints, document why a nonce is not required and keep input validation strict.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #2201 | ReOrder Posts within Categories | 35 | 39 | 207 | 7k+ | Non-prefixed global variable | ||
| #2202 | Reseller Store | 35 | 53 | 34 | 1k+ | Output is not escaped | ||
| #2203 | WP Responsive Tabs horizontal vertical and accordion Tabs | 35 | 598 | 212 | 2k+ | Output is not escaped | ||
| #2204 | Restrict Elementor Widgets, Columns and Sections | 35 | 18 | 53 | 500 | Non-prefixed function | ||
| #2205 | Reveal IDs | 35 | 23 | 13 | 40k+ | Output is not escaped | ||
| #2206 | RPS Image Gallery | 35 | 88 | 16 | 700 | Output is not escaped | ||
| #2207 | sCode (Easy Shortcodes) | 35 | 157 | 97 | 400 | Text Domain Mismatch | ||
| #2208 | Scroll Styler | 35 | 52 | 21 | 900 | Output is not escaped | ||
| #2209 | Internal Links Manager | 35 | 188 | 121 | 10k+ | Output is not escaped | ||
| #2210 | SEO Slider | 35 | 242 | 17 | 1k+ | Text Domain Mismatch | ||
| #2211 | Security Optimizer – The All-In-One Protection Plugin | 35 | 40 | 86 | 1m+ | Input is not sanitized | ||
| #2212 | Shipping Zones by Drawing for WooCommerce | 35 | 278 | 95 | 600 | Text Domain Mismatch | ||
| #2213 | Shop Page WP | 35 | 68 | 23 | 2k+ | Unsafe printing function | ||
| #2214 | Shopkeeper Extender | 35 | 14 | 26 | 5k+ | Missing Version | ||
| #2215 | Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant | 35 | 83 | 76 | 2k+ | Output is not escaped | ||
| #2216 | SHOPVOTE | 35 | 64 | 58 | 400 | curl curl setopt | ||
| #2217 | Shortcake (Shortcode UI) | 35 | 9 | 39 | 10k+ | Request data is not unslashed | ||
| #2218 | Simple CAPTCHA with Cloudflare Turnstile | 35 | 82 | 148 | 100k+ | Output is not escaped | ||
| #2219 | Simple Export Import for ACF Data | 35 | 19 | 64 | 1k+ | Request data is not unslashed | ||
| #2220 | Simple Image Sizes | 35 | 53 | 75 | 60k+ | Unsafe printing function | ||
| #2221 | Simple YouTube Responsive | 35 | 75 | 8 | 3k+ | wp function not compatible with requires wp | ||
| #2222 | Simple Analytics | 35 | 25 | 20 | 1k+ | Output is not escaped | ||
| #2223 | SiteGround Migrator | 35 | 113 | 74 | 80k+ | Missing Arg Domain | ||
| #2224 | SiteOrigin CSS | 35 | 61 | 84 | 100k+ | Not In Footer | ||
| #2225 | WPZOOM Connect: Social Icons Widget, Share Buttons & Click to Chat | 35 | 28 | 31 | 90k+ | Input is not sanitized | ||
| #2226 | Quiz Maker, Poll Maker & Survey Maker by Opinion Stage | 35 | 42 | 32 | 6k+ | Output is not escaped | ||
| #2227 | Spacious Toolkit | 35 | 48 | 94 | 700 | Non-prefixed global variable | ||
| #2228 | Spots | 35 | 195 | 49 | 800 | Output is not escaped | ||
| #2229 | Spreadshop Plugin | 35 | 145 | 44 | 4k+ | wp function not compatible with requires wp | ||
| #2230 | Square Thumbnails | 35 | 43 | 317 | 800 | error log error log | ||
| #2231 | SSL Insecure Content Fixer | 35 | 28 | 60 | 100k+ | Input is not sanitized | ||
| #2232 | Stars Testimonials — Responsive Reviews & Star Ratings | 35 | 29 | 253 | 1k+ | Non-prefixed global variable | ||
| #2233 | Sticky Chat Widget – Floating Chat Icons, Contact Form, Call, Click to Chat, Email & Message Buttons | 35 | 33 | 293 | 10k+ | Non-prefixed global variable | ||
| #2234 | Sticky Social Link | 35 | 49 | 2 | 1k+ | Output is not escaped | ||
| #2235 | StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More | 35 | 524 | 600 | Non-prefixed global variable | |||
| #2236 | String locator | 35 | 52 | 319 | 100k+ | Non-prefixed global variable | ||
| #2237 | Subscribe to Unlock Lite – Opt In Content Locker Plugin for WordPress | 35 | 106 | 145 | 500 | Non-prefixed global variable | ||
| #2238 | SumUp Payment Gateway For WooCommerce | 35 | 29 | 62 | 10k+ | Nonce verification recommended | ||
| #2239 | SweepPress: Website Cleanup and Optimization | 35 | 71 | 176 | 500 | Non-prefixed global variable | ||
| #2240 | ووسلام – همگام سازی ووکامرس و باسلام | 35 | 82 | 426 | 4k+ | Non-prefixed global variable | ||
| #2241 | Tapfiliate | 35 | 35 | 49 | 400 | Nonce verification recommended | ||
| #2242 | Taxonomy CSV Import Export | 35 | 5 | 30 | 700 | Missing nonce verification | ||
| #2243 | TBThemes Theme Import | 35 | 84 | 48 | 400 | Text Domain Mismatch | ||
| #2244 | TC Custom JavaScript | 35 | 19 | 26 | 10k+ | Missing Version | ||
| #2245 | Team Showcase – Responsive Team Members Grid, Slider & Carousel Plugin | 35 | 1,000 | 410 | 2k+ | Text Domain Mismatch | ||
| #2246 | Starter Sites & Templates by Neve | 35 | 28 | 88 | 100k+ | Non-prefixed hook name | ||
| #2247 | Termageddon: Cookie Consent & Privacy Compliance | 35 | 27 | 13 | 7k+ | Exception output is not escaped | ||
| #2248 | Advance Product Search- Voice & Ajax Search for WooCommerce | 35 | 125 | 92 | 10k+ | Text Domain Mismatch | ||
| #2249 | The Courier Guy Shipping for WooCommerce | 35 | 57 | 107 | 3k+ | Missing nonce verification | ||
| #2250 | theMarketer – Email marketing, Newsletters, Automation & Loyalty for Woocommerce | 35 | 4 | 47 | 700 | Nonce verification recommended |
