WordPress.Security.NonceVerification.Recommended
Nonce verification recommended
The code reads request data in a place where Plugin Check recommends a nonce check.
Why It Shows Up
The scan saw request handling that may not always mutate state, but still looks like a user-triggered action that should usually be protected by a nonce.
Why It Matters
Adding a nonce reduces accidental or forged requests and documents that the action is expected to originate from the plugin UI.
How to Fix
- For admin forms and action links, add and verify a nonce.
- For AJAX handlers, use `check_ajax_referer()`.
- For public read-only endpoints, document why a nonce is not required and keep input validation strict.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #2601 | Meks Video Importer | 37 | 62 | 239 | 2k+ | Input is not sanitized | ||
| #2602 | Metorik – Reports & Email Automation for WooCommerce | 37 | 75 | 70 | 10k+ | Output is not escaped | ||
| #2603 | CrawlWP SEO – Instant Search Engine Indexing & SEO Performance Monitor | 37 | 47 | 90 | 40k+ | Dynamic hook name | ||
| #2604 | Monobank WP Payment | 37 | 78 | 41 | 1k+ | Text Domain Mismatch | ||
| #2605 | Nearby Now Reviews and Audio Testimonials | 37 | 66 | 67 | 1k+ | wp function not compatible with requires wp | ||
| #2606 | news ticker benaceur | 37 | 1,097 | 31 | 1k+ | Output is not escaped | ||
| #2607 | Ninja Van (MY) | 37 | 21 | 258 | 1k+ | Non-prefixed global variable | ||
| #2608 | Sendle Shipping Plugin | 37 | 91 | 64 | 800 | wp function not compatible with requires wp | ||
| #2609 | Optin Forms – Simple List Building Plugin for WordPress | 37 | 647 | 22 | 3k+ | Output is not escaped | ||
| #2610 | WP All Export – Order Export for WooCommerce | 37 | 109 | 111 | 4k+ | Text Domain Mismatch | ||
| #2611 | Page scroll to id | 37 | 38 | 120 | 100k+ | Missing nonce verification | ||
| #2612 | PayU CommercePro Plugin | 37 | 218 | 7k+ | error log error log | |||
| #2613 | GoHero Store Customizer for WooCommerce | 37 | 75 | 53 | 600 | Unsafe printing function | ||
| #2614 | Phoenix Media Rename | 37 | 180 | 104 | 50k+ | Output is not escaped | ||
| #2615 | Plexx Elementor Extension | 37 | 582 | 14 | 400 | Text Domain Mismatch | ||
| #2616 | PNG to JPG | 37 | 130 | 173 | 10k+ | Interpolated SQL is not prepared | ||
| #2617 | POEditor | 37 | 78 | 140 | 500 | Output is not escaped | ||
| #2618 | Post Terms Order – per Post based | 37 | 70 | 36 | 2k+ | Output is not escaped | ||
| #2619 | Product page shipping calculator for WooCommerce | 37 | 217 | 117 | 1k+ | Text Domain Mismatch | ||
| #2620 | Quantities and Units for WooCommerce | 37 | 133 | 118 | 1k+ | Output is not escaped | ||
| #2621 | Quentn WP | 37 | 4 | 251 | 500 | Nonce verification recommended | ||
| #2622 | Quick Restaurant Menu | 37 | 136 | 40 | 1k+ | Text Domain Mismatch | ||
| #2623 | resmio button & widget | 37 | 99 | 36 | 400 | Text Domain Mismatch | ||
| #2624 | Rich Table of Contents | 37 | 262 | 57 | 20k+ | Output is not escaped | ||
| #2625 | RSS Image Feed | 37 | 147 | 16 | 2k+ | Output is not escaped | ||
| #2626 | Ryviu – Review Importer & Product Reviews | 37 | 72 | 95 | 1k+ | Output is not escaped | ||
| #2627 | SB RSS feed plus | 37 | 172 | 24 | 1k+ | Output is not escaped | ||
| #2628 | SendWP | 37 | 47 | 42 | 10k+ | Output is not escaped | ||
| #2629 | Sensei LMS Certificates | 37 | 97 | 362 | 4k+ | Non-prefixed global variable | ||
| #2630 | Sezzle Woocommerce Payment | 37 | 108 | 105 | 1k+ | Text Domain Mismatch | ||
| #2631 | Shortcoder — Create Shortcodes for Anything | 37 | 25 | 70 | 100k+ | Non-prefixed global variable | ||
| #2632 | Weaver Show Sliders | 37 | 177 | 132 | 900 | Text Domain Mismatch | ||
| #2633 | Simple Countdown Timer | 37 | 110 | 113 | 1k+ | Missing Arg Domain | ||
| #2634 | Site Offline Or Coming Soon Or Maintenance Mode | 37 | 127 | 138 | 30k+ | Unsafe printing function | ||
| #2635 | Skimlinks Affiliate Marketing Tool | 37 | 84 | 19 | 800 | wp function not compatible with requires wp | ||
| #2636 | Spam Destroyer | 37 | 63 | 43 | 6k+ | rand rand | ||
| #2637 | StagTools | 37 | 476 | 53 | 1k+ | Text Domain Mismatch | ||
| #2638 | Website Pop-up Builder by BDOW! (formerly Sumo): Pop-ups + forms for email opt-ins and lead generation | 37 | 42 | 33 | 10k+ | Output is not escaped | ||
| #2639 | Super Simple Site Offline | 37 | 115 | 59 | 6k+ | Text Domain Mismatch | ||
| #2640 | Swifty Bar, sticky bar by WPGens | 37 | 112 | 81 | 400 | Output is not escaped | ||
| #2641 | Theme Builder For Elementor | 37 | 477 | 28 | 2k+ | Text Domain Mismatch | ||
| #2642 | Tilopay | 37 | 35 | 130 | 1k+ | Nonce verification recommended | ||
| #2643 | Time Clock – A WordPress Employee & Volunteer Time Clock Plugin | 37 | 166 | 107 | 500 | Output is not escaped | ||
| #2644 | Tracking Code Manager | 37 | 55 | 42 | 90k+ | Output is not escaped | ||
| #2645 | Tourfic Toolkit | 37 | 67 | 165 | 1k+ | Post Not In exclude | ||
| #2646 | Ultimate WordPress Auction Plugin | 37 | 623 | 142 | 1k+ | Text Domain Mismatch | ||
| #2647 | Landing Page Builder – Free Landing Page Templates | 37 | 329 | 111 | 600 | Output is not escaped | ||
| #2648 | User Meta Display | 37 | 78 | 74 | 500 | Output is not escaped | ||
| #2649 | UsersWP – Social Login | 37 | 299 | 91 | 2k+ | Text Domain Mismatch | ||
| #2650 | ValidateCertify Free | 37 | 123 | 97 | 1k+ | Text Domain Mismatch |
