WordPress.Security.NonceVerification.Recommended
Nonce verification recommended
The code reads request data in a place where Plugin Check recommends a nonce check.
Why It Shows Up
The scan saw request handling that may not always mutate state, but still looks like a user-triggered action that should usually be protected by a nonce.
Why It Matters
Adding a nonce reduces accidental or forged requests and documents that the action is expected to originate from the plugin UI.
How to Fix
- For admin forms and action links, add and verify a nonce.
- For AJAX handlers, use `check_ajax_referer()`.
- For public read-only endpoints, document why a nonce is not required and keep input validation strict.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #3251 | WP Ajax Load More Pagination and Infinite Scroll | 40 | 63 | 15 | 400 | Output is not escaped | ||
| #3252 | WP Compress for MainWP | 40 | 20 | 36 | 700 | Output is not escaped | ||
| #3253 | Custom CSS/JS | 40 | 58 | 34 | 700 | Text Domain Mismatch | ||
| #3254 | WP Date and Time Shortcode | 40 | 90 | 12 | 10k+ | Output is not escaped | ||
| #3255 | WP Discord Invite | 40 | 73 | 42 | 400 | Unsafe printing function | ||
| #3256 | Easy PayPal & Stripe Buy Now Button | 40 | 388 | 96 | 10k+ | Unsafe printing function | ||
| #3257 | WP Help | 40 | 49 | 54 | 10k+ | Unsafe printing function | ||
| #3258 | WP All Import – Job Listing Import for WP Job Manager | 40 | 35 | 27 | 2k+ | Output is not escaped | ||
| #3259 | WP Keyword Suggest | 40 | 29 | 41 | 500 | Non Singular String Literal Domain | ||
| #3260 | Media Library Categories | 40 | 29 | 49 | 20k+ | Output is not escaped | ||
| #3261 | WP Meteor Website Speed Optimization Addon | 40 | 34 | 19 | 20k+ | Output is not escaped | ||
| #3262 | WP Multisite Content Copier/Updater | 40 | 19 | 144 | 800 | Interpolated SQL is not prepared | ||
| #3263 | QR code MeCard/vCard generator | 40 | 322 | 21 | 2k+ | Unsafe printing function | ||
| #3264 | WP Reroute Email | 40 | 141 | 106 | 1k+ | Output is not escaped | ||
| #3265 | Sentry for WordPress | 40 | 80 | 40 | 10k+ | Text Domain Mismatch | ||
| #3266 | Social Share Buttons & Analytics Plugin – GetSocial.io | 40 | 97 | 25 | 2k+ | Output is not escaped | ||
| #3267 | WP Theme Test | 40 | 21 | 39 | 7k+ | Input is not sanitized | ||
| #3268 | WPFront Notification Bar | 40 | 222 | 44 | 50k+ | Output is not escaped | ||
| #3269 | WPS Menu Exporter | 40 | 47 | 22 | 10k+ | Output is not escaped | ||
| #3270 | XLTab – Accordions and Tabs for Elementor Page Builder | 40 | 317 | 65 | 1k+ | Text Domain Mismatch | ||
| #3271 | My YouTube Channel | 40 | 54 | 38 | 5k+ | Output is not escaped | ||
| #3272 | AMP for WP – Accelerated Mobile Pages | 41 | 656 | 2,401 | 80k+ | Non-prefixed global variable | ||
| #3273 | Ad Auto Insert H | 41 | 496 | 15 | 1k+ | Non Singular String Literal Domain | ||
| #3274 | AddQuicktag | 41 | 86 | 10 | 100k+ | Output is not escaped | ||
| #3275 | Advanced Excerpt | 41 | 69 | 43 | 70k+ | Unsafe printing function | ||
| #3276 | AffiliateWP – Affiliate Product Rates | 41 | 84 | 24 | 2k+ | Output is not escaped | ||
| #3277 | Age Verify | 41 | 29 | 31 | 1k+ | Output is not escaped | ||
| #3278 | Alma – Pay in installments or later for WooCommerce | 41 | 116 | 68 | 1k+ | Exception output is not escaped | ||
| #3279 | Amazon Web Services | 41 | 53 | 21 | 5k+ | Missing Translators Comment | ||
| #3280 | Antispam | 41 | 11 | 41 | 400 | Missing nonce verification | ||
| #3281 | ATP Call Now | 41 | 98 | 7 | 700 | Output is not escaped | ||
| #3282 | Authenticator | 41 | 59 | 44 | 1k+ | Output is not escaped | ||
| #3283 | Autocomplete Google Address | 41 | 22 | 67 | 2k+ | Nonce verification recommended | ||
| #3284 | Avatar Manager | 41 | 29 | 41 | 5k+ | Unsafe printing function | ||
| #3285 | AxiaChat AI – Free AI Chatbot (Answers Customers Automatically) | 41 | 1 | 135 | 2k+ | Interpolated SQL is not prepared | ||
| #3286 | Backend Designer | 41 | 50 | 11 | 1k+ | Output is not escaped | ||
| #3287 | Beam me up Scotty – Back to Top Button | 41 | 71 | 38 | 1k+ | Output is not escaped | ||
| #3288 | Beautiful Cookie Consent Banner | 41 | 33 | 76 | 40k+ | Non-prefixed global variable | ||
| #3289 | BuddyPress Xprofile Custom Field Types | 41 | 39 | 189 | 4k+ | Missing nonce verification | ||
| #3290 | BuddyPress Edit Activity | 41 | 28 | 26 | 800 | Output is not escaped | ||
| #3291 | Bulk Auto Image Title Attribute (Image Title tag) optimizer (Image SEO) | 41 | 16 | 37 | 1k+ | Missing nonce verification | ||
| #3292 | Buzzsprout Podcasting | 41 | 75 | 13 | 5k+ | Non Singular String Literal Domain | ||
| #3293 | Cache control by Cacholong | 41 | 87 | 30 | 500 | Non Singular String Literal Domain | ||
| #3294 | Carbon Copy | 41 | 64 | 89 | 3k+ | Text Domain Mismatch | ||
| #3295 | Easy Social Like Box – Popup – Sidebar Widget | 41 | 217 | 91 | 7k+ | Text Domain Mismatch | ||
| #3296 | Category Wise Search | 41 | 58 | 9 | 500 | Output is not escaped | ||
| #3297 | Conditional Fields for Contact Form 7 | 41 | 106 | 53 | 100k+ | Output is not escaped | ||
| #3298 | Checklist | 41 | 62 | 25 | 400 | Text Domain Mismatch | ||
| #3299 | clickskeks.at Cookiebanner | 41 | 21 | 18 | 500 | Unsafe printing function | ||
| #3300 | CloudGuard | 41 | 41 | 13 | 1k+ | Output is not escaped |
