WordPress.Security.NonceVerification.Recommended
Nonce verification recommended
The code reads request data in a place where Plugin Check recommends a nonce check.
Why It Shows Up
The scan saw request handling that may not always mutate state, but still looks like a user-triggered action that should usually be protected by a nonce.
Why It Matters
Adding a nonce reduces accidental or forged requests and documents that the action is expected to originate from the plugin UI.
How to Fix
- For admin forms and action links, add and verify a nonce.
- For AJAX handlers, use `check_ajax_referer()`.
- For public read-only endpoints, document why a nonce is not required and keep input validation strict.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #2351 | BP Profile Search | 36 | 321 | 85 | 5k+ | Output is not escaped | ||
| #2352 | bpost shipping | 36 | 97 | 43 | 700 | Output is not escaped | ||
| #2353 | Breadcrumb NavXT | 36 | 102 | 111 | 800k+ | Non Singular String Literal Domain | ||
| #2354 | Bulgarisation for WooCommerce | 36 | 135 | 594 | 5k+ | Nonce verification recommended | ||
| #2355 | WOLF – WordPress Posts Bulk Editor and Manager Professional | 36 | 1 | 574 | 4k+ | Request data is not unslashed | ||
| #2356 | Bulk Post Update Date | 36 | 96 | 66 | 10k+ | Unsafe printing function | ||
| #2357 | Bus Ticket Booking with Seat Reservation | 36 | 145 | 192 | 800 | Non-prefixed global variable | ||
| #2358 | Better WordPress Recent Comments | 36 | 319 | 69 | 600 | Text Domain Mismatch | ||
| #2359 | Carousel Ultimate | 36 | 450 | 284 | 700 | Text Domain Mismatch | ||
| #2360 | Carousel Horizontal Posts Content Slider | 36 | 271 | 59 | 2k+ | Text Domain Mismatch | ||
| #2361 | Cashflows for WooCommerce | 36 | 119 | 36 | 600 | Text Domain Mismatch | ||
| #2362 | Simple SEO | 36 | 164 | 113 | 10k+ | Non Singular String Literal Domain | ||
| #2363 | Multi Step for Contact Form 7 | 36 | 61 | 106 | 10k+ | Missing nonce verification | ||
| #2364 | Contact Form 7 Polylang Module | 36 | 32 | 45 | 5k+ | Output is not escaped | ||
| #2365 | CloudPayments Gateway for WooCommerce | 36 | 205 | 70 | 500 | Text Domain Mismatch | ||
| #2366 | CLP – Custom Login Page by NiteoThemes | 36 | 240 | 49 | 700 | Output is not escaped | ||
| #2367 | CM Header and Footer – Add custom scripts and styles to your header and footer with ease | 36 | 230 | 198 | 1k+ | Output is not escaped | ||
| #2368 | Code Snippets | 36 | 34 | 203 | 1m+ | Nonce verification recommended | ||
| #2369 | ColorMeShop WordPress Plugin | 36 | 392 | 37 | 600 | Exception output is not escaped | ||
| #2370 | Coming Soon, Under Construction & Maintenance Mode By Dazzler | 36 | 173 | 132 | 6k+ | Text Domain Mismatch | ||
| #2371 | Conditional Payments for WooCommerce | 36 | 292 | 184 | 10k+ | Text Domain Mismatch | ||
| #2372 | Conditional Shipping for WooCommerce | 36 | 93 | 196 | 10k+ | Non-prefixed global variable | ||
| #2373 | Continuous Image Carousel With Lightbox | 36 | 255 | 129 | 1k+ | Output is not escaped | ||
| #2374 | CP Blocks | 36 | 46 | 38 | 1k+ | wp function not compatible with requires wp | ||
| #2375 | Crelly Slider | 36 | 421 | 185 | 10k+ | Unsafe printing function | ||
| #2376 | CSH Login | 36 | 126 | 41 | 500 | Output is not escaped | ||
| #2377 | Custom Database Applications by Caspio | 36 | 32 | 63 | 400 | Input is not sanitized | ||
| #2378 | Custom PHP Settings | 36 | 153 | 76 | 10k+ | Output is not escaped | ||
| #2379 | Dashboard Widgets Suite | 36 | 206 | 124 | 4k+ | Output is not escaped | ||
| #2380 | Depicter — Popup & Slider Builder | 36 | 130 | 121 | 80k+ | Exception output is not escaped | ||
| #2381 | DeveloPress Sticky Footer Bar | 36 | 165 | 49 | 400 | Output is not escaped | ||
| #2382 | Different Menu in Different Pages – Conditional Menu | 36 | 167 | 113 | 4k+ | Text Domain Mismatch | ||
| #2383 | Doneren met Mollie | 36 | 420 | 351 | 4k+ | SQL query is not prepared | ||
| #2384 | Drag and Drop Multiple File Upload for Contact Form 7 | 36 | 82 | 36 | 60k+ | wp function not compatible with requires wp | ||
| #2385 | Duitku Payment Gateway | 36 | 507 | 107 | 700 | Text Domain Mismatch | ||
| #2386 | Duplicate Post – duplicate pages, copy content, clone posts | 36 | 76 | 81 | 5k+ | wp function not compatible with requires wp | ||
| #2387 | Dynamic Copyright Year | 36 | 972 | 43 | 800 | Output is not escaped | ||
| #2388 | Dynamic Front-End Heartbeat Control | 36 | 217 | 111 | 1k+ | Text Domain Mismatch | ||
| #2389 | Dynamic Visibility for Elementor | 36 | 56 | 89 | 50k+ | Non-prefixed hook name | ||
| #2390 | WP CTA – Call Now Button, Sticky Button & Call to Action Builder | 36 | 1 | 433 | 2k+ | Non-prefixed global variable | ||
| #2391 | Easy Support Videos – Embed videos in the admin | 36 | 160 | 95 | 500 | Output is not escaped | ||
| #2392 | Product Carousel Slider for Elementor | 36 | 148 | 63 | 1k+ | Text Domain Mismatch | ||
| #2393 | Email Before Download | 36 | 89 | 29 | 6k+ | Unsafe printing function | ||
| #2394 | Endora | 36 | 53 | 72 | 1k+ | Output is not escaped | ||
| #2395 | Enhanced Media Library | 36 | 361 | 117 | 60k+ | Unsafe printing function | ||
| #2396 | Enormail Sign Up Forms | 36 | 133 | 126 | 400 | Output is not escaped | ||
| #2397 | Envo's Templates & Widgets for Elementor and WooCommerce | 36 | 1,065 | 54 | 10k+ | Text Domain Mismatch | ||
| #2398 | Events Manager and WPML Compatibility | 36 | 101 | 177 | 1k+ | Direct Query | ||
| #2399 | Export Variable Products | 36 | 79 | 49 | 400 | Text Domain Mismatch | ||
| #2400 | Happy WooCommerce FAQs – Ultimate Product FAQ Plugin | 36 | 65 | 119 | 1k+ | Nonce verification recommended |
