WordPress.Security.NonceVerification.Recommended
Nonce verification recommended
The code reads request data in a place where Plugin Check recommends a nonce check.
Why It Shows Up
The scan saw request handling that may not always mutate state, but still looks like a user-triggered action that should usually be protected by a nonce.
Why It Matters
Adding a nonce reduces accidental or forged requests and documents that the action is expected to originate from the plugin UI.
How to Fix
- For admin forms and action links, add and verify a nonce.
- For AJAX handlers, use `check_ajax_referer()`.
- For public read-only endpoints, document why a nonce is not required and keep input validation strict.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #2851 | VidShop – Shoppable Videos for WooCommerce | 38 | 49 | 144 | 1k+ | Database parameter is not escaped | ||
| #2852 | Ninja Forms Views – Display & Edit Ninja Forms Submissions on your site frontend | 38 | 84 | 49 | 1k+ | Output is not escaped | ||
| #2853 | TWIPLA (Visitor Analytics IO) – Privacy-First Website Stats, Session Recordings, Heatmaps, Polls and Surveys | 38 | 71 | 49 | 900 | Output is not escaped | ||
| #2854 | Visual Admin Customizer | 38 | 20 | 51 | 500 | Input is not sanitized | ||
| #2855 | Chatbox Manager | 38 | 855 | 78 | 400 | Output is not escaped | ||
| #2856 | SSLCommerz Payment Gateway | 38 | 21 | 132 | 2k+ | Non-prefixed global variable | ||
| #2857 | Affiliate Sales in Google Analytics and other tools | 38 | 23 | 84 | 1k+ | Request data is not unslashed | ||
| #2858 | White Label – WordPress Custom Admin, Custom Login Page, and Custom Dashboard | 38 | 205 | 31 | 10k+ | Output is not escaped | ||
| #2859 | WholesaleX – B2B & Wholesale Plugin for WooCommerce with Wholesale Prices | 38 | 40 | 180 | 2k+ | Non-prefixed global variable | ||
| #2860 | WishSuite – Wishlist for WooCommerce | 38 | 76 | 133 | 1k+ | Output is not escaped | ||
| #2861 | Products Coming Soon for WooCommerce | 38 | 151 | 62 | 700 | Output is not escaped | ||
| #2862 | Show Stock Status for WooCommerce | 38 | 30 | 19 | 1k+ | Output is not escaped | ||
| #2863 | Vietnam Checkout for WooCommerce | 38 | 93 | 137 | 10k+ | Nonce verification recommended | ||
| #2864 | Connect WooCommerce Shop to ERP/CRM, Verifactu and EU/VAT Compliance | 38 | 23 | 104 | 1k+ | Direct Query | ||
| #2865 | WP Accessibility Helper (WAH) | 38 | 61 | 88 | 10k+ | Missing direct file access protection | ||
| #2866 | WP Client Reports | 38 | 95 | 80 | 6k+ | Unsafe printing function | ||
| #2867 | WP-DraftsForFriends | 38 | 141 | 71 | 1k+ | Output is not escaped | ||
| #2868 | WP Mailgun SMTP | 38 | 99 | 51 | 900 | Text Domain Mismatch | ||
| #2869 | WP Maintenance Mode & Site Under Construction | 38 | 72 | 57 | 3k+ | Output is not escaped | ||
| #2870 | WP Media Categories | 38 | 40 | 103 | 800 | Nonce verification recommended | ||
| #2871 | Native PHP Sessions | 38 | 30 | 92 | 10k+ | Direct Query | ||
| #2872 | WP Safe Mode | 38 | 95 | 55 | 2k+ | Output is not escaped | ||
| #2873 | External Store for Shopify | 38 | 97 | 33 | 2k+ | Output is not escaped | ||
| #2874 | WP Terms Popup – Terms and Conditions and Privacy Policy WordPress Popups | 38 | 299 | 58 | 3k+ | Non Singular String Literal Domain | ||
| #2875 | WP Video Lightbox | 38 | 107 | 67 | 30k+ | Unsafe printing function | ||
| #2876 | WPC Product Options for WooCommerce | 38 | 57 | 182 | 4k+ | Non-prefixed global variable | ||
| #2877 | Responsive Vertical Icon Menu | 38 | 188 | 85 | 700 | Output is not escaped | ||
| #2878 | WPTurbo -WordPress性能优化插件 | 38 | 20 | 34 | 600 | Output is not escaped | ||
| #2879 | Weather Underground | 38 | 64 | 27 | 3k+ | Output is not escaped | ||
| #2880 | ZeroBounce Email Verification & Validation | 38 | 299 | 162 | 1k+ | Text Domain Mismatch | ||
| #2881 | Zoho Campaigns | 38 | 3 | 129 | 3k+ | Non-prefixed global variable | ||
| #2882 | Smart Custom 404 Error Page | 39 | 90 | 44 | 100k+ | Output is not escaped | ||
| #2883 | ACF: Google Font Selector | 39 | 57 | 45 | 3k+ | Output is not escaped | ||
| #2884 | Ad Invalid Click Protector (AICP) | 39 | 78 | 57 | 10k+ | Text Domain Mismatch | ||
| #2885 | Additional Order Filters for WooCommerce | 39 | 79 | 255 | 2k+ | Nonce verification recommended | ||
| #2886 | Advanced Product Fields (Product Addons) for WooCommerce | 39 | 145 | 145 | 50k+ | Output is not escaped | ||
| #2887 | Advanced Woo Labels – Product Labels & Badges for WooCommerce | 39 | 173 | 125 | 10k+ | Output is not escaped | ||
| #2888 | Affiliate Links – Link Cloaking and Management | 39 | 23 | 113 | 3k+ | Non-prefixed global variable | ||
| #2889 | AffiliatePages – Pros & Cons, Notice, and CTA Blocks for Affiliates | 39 | 91 | 53 | 2k+ | Output is not escaped | ||
| #2890 | AffiliateWP – Affiliate Area Tabs | 39 | 86 | 26 | 3k+ | Output is not escaped | ||
| #2891 | Load More Anything | 39 | 38 | 73 | 5k+ | Output is not escaped | ||
| #2892 | Accessibility by AllAccessible | 39 | 200 | 82 | 2k+ | Unsafe printing function | ||
| #2893 | Andreani WooCommerce | 39 | 21 | 86 | 700 | Non-prefixed global variable | ||
| #2894 | Animate It! | 39 | 137 | 16 | 20k+ | Text Domain Mismatch | ||
| #2895 | Anything Order by Terms | 39 | 48 | 93 | 1k+ | Direct Query | ||
| #2896 | Archive Control | 39 | 151 | 67 | 1k+ | Unsafe printing function | ||
| #2897 | Timeline – Vertical and Horizontal Timeline Layouts | 39 | 500 | 43 | 2k+ | Output is not escaped | ||
| #2898 | bbPress Voting | 39 | 27 | 53 | 500 | Output is not escaped | ||
| #2899 | Benchmark Email Lite | 39 | 86 | 23 | 1k+ | Output is not escaped | ||
| #2900 | Better Random Redirect | 39 | 88 | 40 | 700 | Text Domain Mismatch |
