WordPress.Security.NonceVerification.Recommended
Nonce verification recommended
The code reads request data in a place where Plugin Check recommends a nonce check.
Why It Shows Up
The scan saw request handling that may not always mutate state, but still looks like a user-triggered action that should usually be protected by a nonce.
Why It Matters
Adding a nonce reduces accidental or forged requests and documents that the action is expected to originate from the plugin UI.
How to Fix
- For admin forms and action links, add and verify a nonce.
- For AJAX handlers, use `check_ajax_referer()`.
- For public read-only endpoints, document why a nonce is not required and keep input validation strict.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #3001 | SEO Auto Linker | 39 | 90 | 24 | 1k+ | Text Domain Mismatch | ||
| #3002 | SEO Friendly Images | 39 | 292 | 20 | 20k+ | Output is not escaped | ||
| #3003 | Serial Number for Contact Form 7 | 39 | 105 | 53 | 2k+ | Non Singular String Literal Domain | ||
| #3004 | Shared Files – File Upload & Download Manager | 39 | 5 | 184 | 4k+ | Nonce verification recommended | ||
| #3005 | Shipping by Rules for WooCommerce | 39 | 130 | 48 | 500 | Output is not escaped | ||
| #3006 | Shipping Simulator for WooCommerce | 39 | 120 | 39 | 5k+ | Text Domain Mismatch | ||
| #3007 | Show All Comments | 39 | 108 | 92 | 400 | Nonce verification recommended | ||
| #3008 | Simpaisa Wallet (Jazzcash & Easypaisa) Payment Services | 39 | 67 | 74 | 1k+ | Interpolated Variable Text | ||
| #3009 | Simple Membership WP user Import | 39 | 22 | 46 | 4k+ | Request data is not unslashed | ||
| #3010 | Simple Posts Ticker – Easy, Lightweight & Flexible | 39 | 151 | 28 | 2k+ | Output is not escaped | ||
| #3011 | Simple Staff List | 39 | 90 | 236 | 3k+ | Non-prefixed global variable | ||
| #3012 | Slash Admin | 39 | 116 | 38 | 500 | Output is not escaped | ||
| #3013 | Slideshow SE | 39 | 35 | 240 | 2k+ | Non-prefixed global variable | ||
| #3014 | Smaily for WP | 39 | 52 | 36 | 600 | Output is not escaped | ||
| #3015 | Solid Post Likes | 39 | 96 | 52 | 500 | Text Domain Mismatch | ||
| #3016 | Soumettre.fr | 39 | 130 | 26 | 10k+ | Text Domain Mismatch | ||
| #3017 | Spreadr Woocommerce Plugin – Amazon Importer for Dropshipping and Affiliate | 39 | 42 | 226 | 500 | Request data is not unslashed | ||
| #3018 | Stockdio Historical Chart | 39 | 65 | 16 | 900 | Output is not escaped | ||
| #3019 | Substack Importer | 39 | 33 | 33 | 1k+ | Missing nonce verification | ||
| #3020 | Sync Post With Other Site | 39 | 179 | 21 | 3k+ | Non Singular String Literal Domain | ||
| #3021 | Tabify Edit Screen | 39 | 83 | 27 | 500 | Output is not escaped | ||
| #3022 | Tawk.To Manager | 39 | 204 | 21 | 600 | Output is not escaped | ||
| #3023 | Easy Category Icons | 39 | 50 | 43 | 600 | Text Domain Mismatch | ||
| #3024 | OpenHook | 39 | 172 | 22 | 1k+ | Unsafe printing function | ||
| #3025 | TinyMCE Spellcheck | 39 | 27 | 32 | 2k+ | Unsafe printing function | ||
| #3026 | TomS reCAPTCHA | 39 | 128 | 256 | 500 | Missing nonce verification | ||
| #3027 | Traffic Monitor | 39 | 6 | 143 | 1k+ | Direct Query | ||
| #3028 | UiChemy — Figma Converter for Elementor, Gutenberg and Bricks | 39 | 7 | 100 | 9k+ | Nonce verification recommended | ||
| #3029 | Ultimate Client Dash | 39 | 697 | 12 | 2k+ | Text Domain Mismatch | ||
| #3030 | Ultimate Lightbox | 39 | 110 | 59 | 1k+ | Unsafe printing function | ||
| #3031 | Universal Google Adsense and Ads manager | 39 | 70 | 31 | 2k+ | Unsafe printing function | ||
| #3032 | upPrev | 39 | 35 | 36 | 1k+ | Dynamic hook name | ||
| #3033 | Uptolike Social Share Buttons | 39 | 38 | 33 | 4k+ | Output is not escaped | ||
| #3034 | Use Any Font | Custom Font Uploader | 39 | 36 | 55 | 200k+ | Request data is not unslashed | ||
| #3035 | User Blocker | 39 | 6 | 276 | 3k+ | Nonce verification recommended | ||
| #3036 | Smart Variation Swatches and Attribute Filters for WooCommerce | 39 | 39 | 50 | 3k+ | Output is not escaped | ||
| #3037 | Virtuaria Correios – Frete, Etiqueta, Rastreio e Declaração | 39 | 18 | 81 | 500 | Nonce verification recommended | ||
| #3038 | Virusdie | One-click website security | 39 | 149 | 66 | 2k+ | Output is not escaped | ||
| #3039 | Visual Portfolio, Photo Gallery & Post Grid | 39 | 34 | 189 | 60k+ | Non-prefixed hook name | ||
| #3040 | Payments via PayMongo for WooCommerce | 39 | 36 | 81 | 1k+ | Nonce verification recommended | ||
| #3041 | Smart COD for WooCommerce | 39 | 50 | 28 | 30k+ | Output is not escaped | ||
| #3042 | WebHotelier for WordPress | 39 | 451 | 40 | 500 | Text Domain Mismatch | ||
| #3043 | Wicked Folders – Folder Organizer for Pages, Posts, and Custom Post Types | 39 | 89 | 117 | 20k+ | Unsafe printing function | ||
| #3044 | Woo Button Text | 39 | 53 | 21 | 500 | Output is not escaped | ||
| #3045 | Combo Offers WooCommerce | 39 | 38 | 89 | 2k+ | Missing nonce verification | ||
| #3046 | CURCY – Multi Currency for WooCommerce – Smoothly on WooCommerce 9.x | 39 | 7 | 222 | 20k+ | Non-prefixed hook name | ||
| #3047 | PayU GPO Payment for WooCommerce | 39 | 44 | 91 | 10k+ | Output is not escaped | ||
| #3048 | Modal Fly Cart & AJAX Add to Cart for WooCommerce | 39 | 83 | 74 | 2k+ | Text Domain Mismatch | ||
| #3049 | Claudio Sanches – PagSeguro for WooCommerce | 39 | 87 | 37 | 10k+ | Unsafe printing function | ||
| #3050 | WP Accessibility | 39 | 200 | 104 | 60k+ | Unsafe printing function |
