WordPress.Security.NonceVerification.Recommended
Nonce verification recommended
The code reads request data in a place where Plugin Check recommends a nonce check.
Why It Shows Up
The scan saw request handling that may not always mutate state, but still looks like a user-triggered action that should usually be protected by a nonce.
Why It Matters
Adding a nonce reduces accidental or forged requests and documents that the action is expected to originate from the plugin UI.
How to Fix
- For admin forms and action links, add and verify a nonce.
- For AJAX handlers, use `check_ajax_referer()`.
- For public read-only endpoints, document why a nonce is not required and keep input validation strict.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #2651 | Varnish/Nginx Proxy Caching | 37 | 287 | 36 | 600 | Output is not escaped | ||
| #2652 | ViaBill – WooCommerce | 37 | 437 | 86 | 500 | Text Domain Mismatch | ||
| #2653 | Virtual Classroom – Video Conferencing & Online Meeting with BigBlueButton | 37 | 45 | 140 | 400 | Nonce verification recommended | ||
| #2654 | Featured Video for WordPress – VideographyWP | 37 | 287 | 93 | 1k+ | Unsafe printing function | ||
| #2655 | Views for WPForms – Display & Edit WPForms Entries on your site frontend | 37 | 80 | 64 | 1k+ | Output is not escaped | ||
| #2656 | Innovs WPBakery Visual Composer WHMCS Elements | 37 | 154 | 24 | 2k+ | Text Domain Mismatch | ||
| #2657 | Weather Atlas Widget | 37 | 630 | 111 | 8k+ | Output is not escaped | ||
| #2658 | Widget Box Lite | 37 | 318 | 17 | 900 | Output is not escaped | ||
| #2659 | Conditional Discounts for WooCommerce – A simple yet complete woocommerce dynamic pricing plugin | 37 | 99 | 33 | 9k+ | Text Domain Mismatch | ||
| #2660 | Orders Tracking for WooCommerce | 37 | 7 | 312 | 10k+ | Request data is not unslashed | ||
| #2661 | Módulo PagSeguro | 37 | 90 | 46 | 1k+ | Unsafe printing function | ||
| #2662 | Piraeus Bank WooCommerce Payment Gateway | 37 | 146 | 104 | 3k+ | Non Singular String Literal Domain | ||
| #2663 | SUMIT Payment Gateway for WooCommerce | 37 | 358 | 74 | 1k+ | Text Domain Mismatch | ||
| #2664 | Variation Swatches for WooCommerce | 37 | 92 | 103 | 10k+ | Output is not escaped | ||
| #2665 | Xendit Payment | 37 | 3 | 197 | 3k+ | Missing nonce verification | ||
| #2666 | WP WooCommerce Mailchimp | 37 | 62 | 85 | 6k+ | Non-prefixed hook name | ||
| #2667 | WooCommerce PayPal Payments | 37 | 194 | 110 | 800k+ | Exception output is not escaped | ||
| #2668 | Quickpay for WooCommerce | 37 | 66 | 56 | 4k+ | Nonce verification recommended | ||
| #2669 | Hustle – Email Marketing, Lead Generation, Optins, Popups | 37 | 4,894 | 5,942 | 90k+ | Non-prefixed global variable | ||
| #2670 | WP Category Permalink | 37 | 75 | 31 | 2k+ | Output is not escaped | ||
| #2671 | WP-Cron Control | 37 | 54 | 22 | 1k+ | Output is not escaped | ||
| #2672 | WP Export Categories & Taxonomies | 37 | 169 | 35 | 500 | Output is not escaped | ||
| #2673 | WPForce Logout – WordPress User Login Logout Management Plugin | 37 | 567 | 32 | 8k+ | Output is not escaped | ||
| #2674 | WP FullCalendar | 37 | 32 | 64 | 8k+ | Nonce verification recommended | ||
| #2675 | WP Image Markers – Easy Hotspot Solution | 37 | 179 | 66 | 700 | Text Domain Mismatch | ||
| #2676 | WP Flow Plus | 37 | 175 | 146 | 800 | Output is not escaped | ||
| #2677 | Persistent Login | 37 | 338 | 108 | 6k+ | Unsafe printing function | ||
| #2678 | WP Plugin Info Card | 37 | 53 | 376 | 500 | Nonce verification recommended | ||
| #2679 | ReCaptcha Integration for WordPress | 37 | 60 | 66 | 9k+ | Output is not escaped | ||
| #2680 | WPElemento Importer | 37 | 121 | 88 | 9k+ | Text Domain Mismatch | ||
| #2681 | WPO365 | MICROSOFT 365 GRAPH MAILER | 37 | 112 | 83 | 10k+ | Text Domain Mismatch | ||
| #2682 | WP VR – 360 Panorama and Virtual Tour Builder | 37 | 3 | 275 | 10k+ | Non-prefixed hook name | ||
| #2683 | Yada Wiki | 37 | 207 | 45 | 2k+ | Text Domain Mismatch | ||
| #2684 | YOURLS Link Creator | 37 | 196 | 39 | 500 | Text Domain Mismatch | ||
| #2685 | Zakeke Interactive Product Designer for WooCommerce | 37 | 186 | 177 | 2k+ | Nonce verification recommended | ||
| #2686 | Zoho Marketing Automation | 37 | 24 | 194 | 1k+ | Non-prefixed global variable | ||
| #2687 | Zendesk Chat | 37 | 44 | 67 | 10k+ | Output is not escaped | ||
| #2688 | Accessibility | 38 | 66 | 61 | 1k+ | Non-prefixed global variable | ||
| #2689 | AccessibleWP – Accessibility Toolbar | 38 | 381 | 26 | 20k+ | Text Domain Mismatch | ||
| #2690 | ACF-VC Integrator | 38 | 190 | 91 | 3k+ | Output is not escaped | ||
| #2691 | Add Customer for WooCommerce | 38 | 229 | 153 | 1k+ | Text Domain Mismatch | ||
| #2692 | Admin Bar Editor – Toolbar Customization with User Role based access & Custom menus | 38 | 56 | 46 | 3k+ | Output is not escaped | ||
| #2693 | Admin Bar & Dashboard Access Control | 38 | 94 | 37 | 3k+ | Text Domain Mismatch | ||
| #2694 | Admin Management Xtended | 38 | 280 | 161 | 5k+ | Output is not escaped | ||
| #2695 | AdRoll for WooCommerce Stores | 38 | 40 | 25 | 600 | Output is not escaped | ||
| #2696 | AWCA – The Great Analytics Insights for Your eStore | 38 | 238 | 143 | 2k+ | Output is not escaped | ||
| #2697 | Advanced 301 and 302 Redirect | 38 | 81 | 339 | 1k+ | Non-prefixed global variable | ||
| #2698 | Advanced Media Offloader | 38 | 57 | 94 | 5k+ | error log error log | ||
| #2699 | Advanced Product Search For WooCommerce | 38 | 160 | 38 | 4k+ | Text Domain Mismatch | ||
| #2700 | Advanced Sermons | 38 | 833 | 184 | 1k+ | Unsafe printing function |
