WordPress.Security.NonceVerification.Recommended
Nonce verification recommended
The code reads request data in a place where Plugin Check recommends a nonce check.
Why It Shows Up
The scan saw request handling that may not always mutate state, but still looks like a user-triggered action that should usually be protected by a nonce.
Why It Matters
Adding a nonce reduces accidental or forged requests and documents that the action is expected to originate from the plugin UI.
How to Fix
- For admin forms and action links, add and verify a nonce.
- For AJAX handlers, use `check_ajax_referer()`.
- For public read-only endpoints, document why a nonce is not required and keep input validation strict.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #3201 | RPB Chessboard | 40 | 86 | 98 | 1k+ | Missing direct file access protection | ||
| #3202 | Sales Tax Reports For WooCommerce | 40 | 50 | 65 | 900 | Output is not escaped | ||
| #3203 | Search Live | 40 | 132 | 71 | 600 | Output is not escaped | ||
| #3204 | Search with Typesense | 40 | 81 | 122 | 700 | Non-prefixed global variable | ||
| #3205 | Secondary Title | 40 | 117 | 31 | 7k+ | Unsafe printing function | ||
| #3206 | Select All Categories and Taxonomies, Change Checkbox to Radio Buttons | 40 | 116 | 30 | 3k+ | Output is not escaped | ||
| #3207 | Serviceform Pixel | 40 | 18 | 22 | 400 | Output is not escaped | ||
| #3208 | Multipage | 40 | 72 | 28 | 900 | Unsafe printing function | ||
| #3209 | Simple Statistics for Feeds | 40 | 64 | 131 | 800 | Nonce verification recommended | ||
| #3210 | Simple Link List Widget | 40 | 129 | 8 | 2k+ | Output is not escaped | ||
| #3211 | Simple Page Sidebars | 40 | 55 | 65 | 10k+ | Output is not escaped | ||
| #3212 | SiteSEO – SEO Simplified | 40 | 36 | 119 | 500k+ | Nonce verification recommended | ||
| #3213 | Specific Content For Mobile – Customize the mobile version without redirections | 40 | 26 | 155 | 4k+ | Nonce verification recommended | ||
| #3214 | SportsPress for Cricket | 40 | 122 | 34 | 500 | Text Domain Mismatch | ||
| #3215 | ST Demo Importer | 40 | 27 | 75 | 800 | Missing nonce verification | ||
| #3216 | Stax Addons for Elementor | 40 | 143 | 81 | 500 | Output is not escaped | ||
| #3217 | CPS | Age Verification | 40 | 127 | 35 | 800 | Unsafe printing function | ||
| #3218 | Developer Tools Blocker | 40 | 35 | 47 | 400 | strip tags strip tags | ||
| #3219 | Tealium | 40 | 73 | 19 | 600 | Unsafe printing function | ||
| #3220 | Theme and plugin translation for Polylang (TTfP) | 40 | 102 | 62 | 10k+ | Text Domain Mismatch | ||
| #3221 | Multiple Shipping Addresses for WooCommerce (Address Book) | 40 | 21 | 208 | 2k+ | Non-prefixed global variable | ||
| #3222 | ThemeZee Toolkit | 40 | 44 | 116 | 6k+ | Nonce verification recommended | ||
| #3223 | Thin Out Revisions | 40 | 93 | 35 | 800 | Non Singular String Literal Domain | ||
| #3224 | Timed Content | 40 | 76 | 63 | 5k+ | Unsafe printing function | ||
| #3225 | Track Geolocation Of Users Using Contact Form 7 | 40 | 17 | 173 | 900 | Nonce verification recommended | ||
| #3226 | turboSMTP | 40 | 114 | 112 | 400 | Unsafe printing function | ||
| #3227 | Ultimate Dashboard – Custom WordPress Dashboard | 40 | 17 | 144 | 60k+ | Input is not sanitized | ||
| #3228 | Ultimate Member – ForumWP forum integration | 40 | 31 | 73 | 500 | Nonce verification recommended | ||
| #3229 | Unlimited Logo Carousel | 40 | 286 | 15 | 500 | Text Domain Mismatch | ||
| #3230 | Url Rewrite Analyzer | 40 | 73 | 23 | 400 | Unsafe printing function | ||
| #3231 | UsersWP – ReCaptcha | 40 | 80 | 17 | 3k+ | Text Domain Mismatch | ||
| #3232 | UTM Leads Tracker – XLPlugins | 40 | 21 | 38 | 400 | Output is not escaped | ||
| #3233 | Visibility Control for LearnDash | 40 | 55 | 23 | 1k+ | Missing Arg Domain | ||
| #3234 | Visibility Control for LearnPress | 40 | 52 | 19 | 700 | Missing Arg Domain | ||
| #3235 | Visma Pay for Woocommerce | 40 | 27 | 37 | 1k+ | Output is not escaped | ||
| #3236 | Visual Builder for Contact Form 7 | 40 | 20 | 43 | 500 | Output is not escaped | ||
| #3237 | WooBooster Partial COD for WooCommerce | 40 | 90 | 51 | 500 | Text Domain Mismatch | ||
| #3238 | Where Did You Hear About Us Checkout Field for WooCommerce | 40 | 57 | 66 | 1k+ | Output is not escaped | ||
| #3239 | WC Search Orders By Product | 40 | 47 | 66 | 800 | Nonce verification recommended | ||
| #3240 | Webo-facto | 40 | 41 | 102 | 1k+ | Nonce verification recommended | ||
| #3241 | Weight Based Pricing for WooCommerce | 40 | 167 | 86 | 600 | Text Domain Mismatch | ||
| #3242 | Wider Admin Menu | 40 | 76 | 17 | 2k+ | Output is not escaped | ||
| #3243 | Widget Menuizer | 40 | 44 | 26 | 600 | Missing Arg Domain | ||
| #3244 | Widget Visibility Without Jetpack | 40 | 74 | 47 | 5k+ | Text Domain Mismatch | ||
| #3245 | Widgets Control | 40 | 92 | 47 | 800 | Output is not escaped | ||
| #3246 | WPC Frequently Bought Together for WooCommerce | 40 | 63 | 109 | 10k+ | Output is not escaped | ||
| #3247 | Total Sales Counts for WooCommerce | 40 | 121 | 62 | 700 | SQL query is not prepared | ||
| #3248 | Additional Variation Images Gallery for WooCommerce | 40 | 60 | 129 | 20k+ | Non-prefixed global variable | ||
| #3249 | Wallet for WooCommerce | 40 | 32 | 524 | 20k+ | Non-prefixed hook name | ||
| #3250 | Simple Registration for WooCommerce | 40 | 27 | 55 | 4k+ | Missing nonce verification |
