WordPress.Security.NonceVerification.Recommended
Nonce verification recommended
The code reads request data in a place where Plugin Check recommends a nonce check.
Why It Shows Up
The scan saw request handling that may not always mutate state, but still looks like a user-triggered action that should usually be protected by a nonce.
Why It Matters
Adding a nonce reduces accidental or forged requests and documents that the action is expected to originate from the plugin UI.
How to Fix
- For admin forms and action links, add and verify a nonce.
- For AJAX handlers, use `check_ajax_referer()`.
- For public read-only endpoints, document why a nonce is not required and keep input validation strict.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #2951 | HD Quiz | 39 | 252 | 82 | 7k+ | Output is not escaped | ||
| #2952 | Hide My WP Lite | 39 | 24 | 62 | 400 | Nonce verification recommended | ||
| #2953 | Maintenance Mode | 39 | 86 | 109 | 7k+ | Output is not escaped | ||
| #2954 | Idle User Logout | 39 | 96 | 13 | 1k+ | Output is not escaped | ||
| #2955 | If Menu – Visibility control for Menus | 39 | 281 | 63 | 50k+ | Output is not escaped | ||
| #2956 | Image Watermark WP | 39 | 88 | 82 | 600 | Output is not escaped | ||
| #2957 | S2W – Import Shopify to WooCommerce | 39 | 8 | 132 | 3k+ | Request data is not unslashed | ||
| #2958 | Improved Save Button | 39 | 44 | 52 | 4k+ | Missing Translators Comment | ||
| #2959 | Insert Html Snippet | 39 | 159 | 205 | 20k+ | Output is not escaped | ||
| #2960 | involve.me – Create Surveys, Quizzes, Calculators & Forms as Embedded Widgets or Pop-ups | 39 | 158 | 32 | 400 | Text Domain Mismatch | ||
| #2961 | JetGridBuilder — Grid Builder for Elementor and Gutenberg | 39 | 414 | 40 | 4k+ | Text Domain Mismatch | ||
| #2962 | LH Add Media From Url | 39 | 42 | 26 | 2k+ | Output is not escaped | ||
| #2963 | Library Viewer | 39 | 65 | 93 | 400 | Non-prefixed hook name | ||
| #2964 | LuckyWP Table of Contents | 39 | 438 | 62 | 100k+ | Output is not escaped | ||
| #2965 | Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid | 39 | 65 | 72 | 6k+ | block api version too low | ||
| #2966 | Mail Subscribe List | 39 | 17 | 94 | 3k+ | Input is not validated | ||
| #2967 | MailChimp Add-On for FormCraft | 39 | 56 | 29 | 800 | curl curl setopt | ||
| #2968 | Manage Enrollment for LearnDash | 39 | 48 | 79 | 400 | Unsafe printing function | ||
| #2969 | Kikote – Location Picker at Checkout & Google Address AutoFill Plugin for WooCommerce | 39 | 76 | 64 | 1k+ | Missing Translators Comment | ||
| #2970 | Maps for WP | 39 | 169 | 73 | 400 | Output is not escaped | ||
| #2971 | Markup by Attribute for WooCommerce | 39 | 46 | 102 | 2k+ | Direct Query | ||
| #2972 | Mascaras CF7 | 39 | 54 | 16 | 1k+ | Text Domain Mismatch | ||
| #2973 | Mega Addons For WPBakery Page Builder | 39 | 1,320 | 154 | 20k+ | Text Domain Mismatch | ||
| #2974 | Meks Easy Photo Feed Widget | 39 | 77 | 27 | 10k+ | Output is not escaped | ||
| #2975 | Menubar | 39 | 171 | 46 | 1k+ | Output is not escaped | ||
| #2976 | Zen Feed | 39 | 39 | 22 | 400 | Output is not escaped | ||
| #2977 | Mizan Demo Importer | 39 | 31 | 68 | 1k+ | Missing Version | ||
| #2978 | Modal Dialog | 39 | 64 | 64 | 500 | Output is not escaped | ||
| #2979 | Movable Type and TypePad Importer | 39 | 42 | 25 | 20k+ | Output is not escaped | ||
| #2980 | Multilingual Contact Form 7 with Polylang | 39 | 50 | 30 | 9k+ | Text Domain Mismatch | ||
| #2981 | Social Proof Popups & Real-Time Notifications – Herd Effects | 39 | 5 | 181 | 1k+ | Non-prefixed global variable | ||
| #2982 | NextGEN Download Gallery | 39 | 57 | 21 | 2k+ | Short PHP open tag found | ||
| #2983 | Pay by paynow.pl | 39 | 51 | 56 | 6k+ | Output is not escaped | ||
| #2984 | payever – WooCommerce Gateway | 39 | 263 | 131 | 800 | Text Domain Mismatch | ||
| #2985 | Paystack Add-On for Gravity Forms | 39 | 96 | 31 | 400 | Text Domain Mismatch | ||
| #2986 | Designil PDPA Thailand | 39 | 131 | 36 | 3k+ | Output is not escaped | ||
| #2987 | PO/MO Editor | 39 | 106 | 45 | 1k+ | Unsafe printing function | ||
| #2988 | Privilege Menu | 39 | 215 | 49 | 1k+ | Text Domain Mismatch | ||
| #2989 | Product Size Chart for Woocommerce | 39 | 20 | 169 | 600 | Non-prefixed global variable | ||
| #2990 | Quantcast Choice | 39 | 227 | 11 | 3k+ | Text Domain Mismatch | ||
| #2991 | Query Multiple Taxonomies | 39 | 55 | 41 | 500 | Output is not escaped | ||
| #2992 | Quform Mailchimp | 39 | 65 | 147 | 800 | Nonce verification recommended | ||
| #2993 | Quform Zapier | 39 | 60 | 123 | 1k+ | Nonce verification recommended | ||
| #2994 | Simple Webchat | 39 | 142 | 204 | 1k+ | Output is not escaped | ||
| #2995 | Redirect 404 Error Page to Homepage or Custom Page with Logs | 39 | 27 | 53 | 10k+ | Nonce verification recommended | ||
| #2996 | Re Gallery – Responsive Image & Photo Gallery | 39 | 16 | 121 | 700 | Missing nonce verification | ||
| #2997 | Reorder by Term | 39 | 20 | 84 | 1k+ | Request data is not unslashed | ||
| #2998 | REST API Helper | 39 | 108 | 85 | 500 | Unsafe printing function | ||
| #2999 | RioVizual — Table Blocks for Comparison, Pricing and Pros & Cons | 39 | 32 | 75 | 1k+ | Nonce verification recommended | ||
| #3000 | Scripts n Styles | 39 | 150 | 92 | 30k+ | Output is not escaped |
