WordPress.Security.NonceVerification.Recommended
Nonce verification recommended
The code reads request data in a place where Plugin Check recommends a nonce check.
Why It Shows Up
The scan saw request handling that may not always mutate state, but still looks like a user-triggered action that should usually be protected by a nonce.
Why It Matters
Adding a nonce reduces accidental or forged requests and documents that the action is expected to originate from the plugin UI.
How to Fix
- For admin forms and action links, add and verify a nonce.
- For AJAX handlers, use `check_ajax_referer()`.
- For public read-only endpoints, document why a nonce is not required and keep input validation strict.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #2901 | Blackhole for Bad Bots | 39 | 123 | 69 | 30k+ | Output is not escaped | ||
| #2902 | Blogger Importer Extended | 39 | 55 | 45 | 4k+ | Output is not escaped | ||
| #2903 | Bogo | 39 | 30 | 139 | 10k+ | Request data is not unslashed | ||
| #2904 | BOX NOW Delivery Croatia | 39 | 64 | 99 | 700 | Missing nonce verification | ||
| #2905 | Bulk Auto Image Alt Text (Alt tag, Alt attribute) optimizer (image SEO) | 39 | 16 | 47 | 10k+ | Request data is not unslashed | ||
| #2906 | Bulk NoIndex & NoFollow Toolkit | 39 | 72 | 172 | 2k+ | Nonce verification recommended | ||
| #2907 | Better WordPress External Links | 39 | 130 | 35 | 400 | Non Singular String Literal Domain | ||
| #2908 | Calculator Builder – Create an Online Calculator | 39 | 16 | 221 | 1k+ | Non-prefixed global variable | ||
| #2909 | Saitama Addon Pack | 39 | 152 | 27 | 1k+ | Output is not escaped | ||
| #2910 | Contact Form 7 extension for Google Map fields | 39 | 118 | 58 | 500 | Missing Arg Domain | ||
| #2911 | Innozilla Skins for Contact Form 7 | 39 | 152 | 22 | 2k+ | Output is not escaped | ||
| #2912 | Constant Contact + WooCommerce | 39 | 27 | 91 | 1k+ | Nonce verification recommended | ||
| #2913 | Contact Form 7 – Dynamic Text Extension | 39 | 103 | 28 | 100k+ | Output is not escaped | ||
| #2914 | Image CAPTCHA for Contact Form 7 and WPForms by HookAndHook (DSGVO/GDPR) | 39 | 28 | 45 | 80k+ | Missing nonce verification | ||
| #2915 | Content Visibility for Divi Builder | 39 | 184 | 59 | 2k+ | Non Singular String Literal Domain | ||
| #2916 | Cookies for Comments | 39 | 22 | 29 | 20k+ | Input is not validated | ||
| #2917 | Country & Phone Field Contact Form 7 | 39 | 117 | 34 | 40k+ | Text Domain Mismatch | ||
| #2918 | Culqi | 39 | 571 | 88 | 1k+ | Text Domain Mismatch | ||
| #2919 | Custom Post Type Auto Menu | 39 | 54 | 33 | 500 | Text Domain Mismatch | ||
| #2920 | Custom Related Posts | 39 | 131 | 34 | 3k+ | Output is not escaped | ||
| #2921 | Custom Thank You for WooCommerce | 39 | 107 | 57 | 400 | Output is not escaped | ||
| #2922 | Da Reactions | 39 | 15 | 140 | 400 | Request data is not unslashed | ||
| #2923 | Dashboard Cleaner | 39 | 40 | 91 | 500 | Missing nonce verification | ||
| #2924 | Datalogics Ecommerce Delivery – Datalogics | 39 | 13 | 115 | 500 | Nonce verification recommended | ||
| #2925 | DefendWP Firewall | 39 | 16 | 203 | 3k+ | Non-prefixed global variable | ||
| #2926 | Deliverability – pass DKIM, SPF, DMARC & more | 39 | 21 | 71 | 800 | Nonce verification recommended | ||
| #2927 | Drip for Gravity Forms | 39 | 41 | 21 | 500 | Unsafe printing function | ||
| #2928 | Duplicate Killer – Prevent Duplicate Form Submissions | 39 | 57 | 103 | 1k+ | Non-prefixed global variable | ||
| #2929 | WeShareAI – AI-Powered Share Buttons (formerly E-MAILiT) | 39 | 165 | 24 | 700 | Unsafe printing function | ||
| #2930 | Easy PayPal Events & Tickets | 39 | 28 | 550 | 1k+ | Request data is not unslashed | ||
| #2931 | Editor Menu and Widget Access | 39 | 81 | 24 | 7k+ | Output is not escaped | ||
| #2932 | Caldera Forms styler for Elementor Page Builder | 39 | 173 | 12 | 700 | Text Domain Mismatch | ||
| #2933 | ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor | 39 | 73 | 348 | 1m+ | Non-prefixed global variable | ||
| #2934 | Email Marketing by EmailOctopus | 39 | 43 | 62 | 3k+ | Non-prefixed global variable | ||
| #2935 | Events Manager – Zoom Integration | 39 | 141 | 43 | 700 | Output is not escaped | ||
| #2936 | BestWebSoft's Like & Share – Posts, Pages and Widget Social Extension plugin for WordPress | 39 | 480 | 226 | 4k+ | Text Domain Mismatch | ||
| #2937 | FaniMani.pl | 39 | 103 | 11 | 600 | Output is not escaped | ||
| #2938 | Favorites | 39 | 187 | 123 | 10k+ | Unsafe printing function | ||
| #2939 | Fix Duplicates | 39 | 76 | 73 | 800 | Output is not escaped | ||
| #2940 | Flamix: Bitrix24 and WooCommerce Orders integration | 39 | 81 | 31 | 500 | Output is not escaped | ||
| #2941 | GDPRess | Eliminate external requests to increase GDPR compliance | 39 | 60 | 26 | 1k+ | Output is not escaped | ||
| #2942 | Genesis Dambuster | 39 | 94 | 67 | 3k+ | Output is not escaped | ||
| #2943 | GF Mollie by Indigo | 39 | 82 | 33 | 900 | Exception output is not escaped | ||
| #2944 | GL Import External Images | 39 | 118 | 19 | 800 | wp function not compatible with requires wp | ||
| #2945 | Prisna GWT – Google Website Translator | 39 | 117 | 77 | 8k+ | Text Domain Mismatch | ||
| #2946 | GoSMTP – SMTP for WordPress | 39 | 59 | 42 | 500k+ | Output is not escaped | ||
| #2947 | Graphina – Charts and Graphs For Elementor | 39 | 1,910 | 113 | 10k+ | Text Domain Mismatch | ||
| #2948 | Gravity Slider Fields | 39 | 56 | 36 | 2k+ | Text Domain Mismatch | ||
| #2949 | GS Only PDF Preview | 39 | 46 | 36 | 1k+ | Output is not escaped | ||
| #2950 | Gutenverse News – News Blocks for Blog & Magazine Sites | 39 | 37 | 65 | 800 | Non-prefixed hook name |
