WordPress.Security.NonceVerification.Recommended
Nonce verification recommended
The code reads request data in a place where Plugin Check recommends a nonce check.
Why It Shows Up
The scan saw request handling that may not always mutate state, but still looks like a user-triggered action that should usually be protected by a nonce.
Why It Matters
Adding a nonce reduces accidental or forged requests and documents that the action is expected to originate from the plugin UI.
How to Fix
- For admin forms and action links, add and verify a nonce.
- For AJAX handlers, use `check_ajax_referer()`.
- For public read-only endpoints, document why a nonce is not required and keep input validation strict.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #3301 | CloudGuard | 41 | 41 | 13 | 1k+ | Output is not escaped | ||
| #3302 | Colorful Categories | 41 | 20 | 20 | 2k+ | Output is not escaped | ||
| #3303 | Comments Like Dislike | 41 | 172 | 20 | 5k+ | Non Singular String Literal Domain | ||
| #3304 | Contact Form 7 Captcha | 41 | 7 | 75 | 100k+ | Request data is not unslashed | ||
| #3305 | Controlled Admin Access | 41 | 22 | 40 | 10k+ | Nonce verification recommended | ||
| #3306 | Cookie Notice & Consent | 41 | 101 | 29 | 1k+ | Output is not escaped | ||
| #3307 | Simple Website Banner | 41 | 106 | 8 | 700 | Output is not escaped | ||
| #3308 | CurrencyConverter | 41 | 629 | 6 | 700 | Non Singular String Literal Domain | ||
| #3309 | Database for CF7 | 41 | 37 | 32 | 2k+ | Text Domain Mismatch | ||
| #3310 | Debug Bar | 41 | 64 | 25 | 20k+ | Output is not escaped | ||
| #3311 | Developer Loggers for Simple History | 41 | 46 | 28 | 400 | Text Domain Mismatch | ||
| #3312 | Dinamize | 41 | 41 | 65 | 500 | Output is not escaped | ||
| #3313 | Disable Everything | 41 | 90 | 16 | 30k+ | Output is not escaped | ||
| #3314 | Disqus Conditional Load | 41 | 38 | 14 | 3k+ | Output is not escaped | ||
| #3315 | Duplicate Post Page Menu & Custom Post Type | 41 | 35 | 11 | 10k+ | Text Domain Mismatch | ||
| #3316 | Edit Lock | 41 | 47 | 22 | 500 | Non Singular String Literal Domain | ||
| #3317 | Essential Form – The lightest plugin for contact forms, ultra lightweight and no spam | 41 | 21 | 53 | 500 | Missing nonce verification | ||
| #3318 | Payment Gateway of PayPal for WooCommerce | 41 | 44 | 184 | 7k+ | Nonce verification recommended | ||
| #3319 | Extra User Details | 41 | 84 | 15 | 1k+ | Non Singular String Literal Domain | ||
| #3320 | Flexible Posts Widget | 41 | 136 | 33 | 7k+ | Output is not escaped | ||
| #3321 | Google Authenticator | 41 | 39 | 65 | 20k+ | Output is not escaped | ||
| #3322 | (Simply) Guest Author Name | 41 | 35 | 36 | 2k+ | Output is not escaped | ||
| #3323 | Hash Form – Drag & Drop Form Builder | 41 | 9 | 275 | 3k+ | Non-prefixed global variable | ||
| #3324 | Hide WP Admin Login | 41 | 23 | 39 | 500 | Nonce verification recommended | ||
| #3325 | Highcompress Image Compressor | 41 | 106 | 69 | 600 | Text Domain Mismatch | ||
| #3326 | iCount Payment Gateway | 41 | 152 | 22 | 500 | Text Domain Mismatch | ||
| #3327 | Import external attachments | 41 | 18 | 26 | 2k+ | Output is not escaped | ||
| #3328 | Infinite Ajax Scrolling Lite For Woocommerce | 41 | 33 | 28 | 500 | Output is not escaped | ||
| #3329 | Inpost Paczkomaty | 41 | 35 | 68 | 8k+ | Text Domain Mismatch | ||
| #3330 | Multiple Themes | 41 | 112 | 41 | 10k+ | Output is not escaped | ||
| #3331 | Social Sharing Plugin – Kiwi | 41 | 23 | 80 | 4k+ | Non-prefixed global variable | ||
| #3332 | Central Color Palette | 41 | 73 | 33 | 10k+ | Output is not escaped | ||
| #3333 | Lazy Load Optimizer | 41 | 63 | 26 | 3k+ | Unsafe printing function | ||
| #3334 | Lockdown WP Admin | 41 | 20 | 50 | 10k+ | Request data is not unslashed | ||
| #3335 | Log cleaner for Solid Security | 41 | 65 | 47 | 8k+ | Text Domain Mismatch | ||
| #3336 | Media Grid | 41 | 42 | 44 | 2k+ | Missing Arg Domain | ||
| #3337 | Mobile Contact Bar | 41 | 94 | 36 | 10k+ | Unsafe printing function | ||
| #3338 | Mollie Forms | 41 | 14 | 565 | 3k+ | Request data is not unslashed | ||
| #3339 | MouseWheel Smooth Scroll | 41 | 104 | 7 | 100k+ | Text Domain Mismatch | ||
| #3340 | My Wp Brand – Hide menu & Hide Plugin | 41 | 74 | 50 | 2k+ | Non Singular String Literal Domain | ||
| #3341 | Social Login | 41 | 8 | 110 | 5k+ | Input is not sanitized | ||
| #3342 | Live Chat & AI Chatbot – onWebChat | 41 | 31 | 91 | 700 | error log error log | ||
| #3343 | Optimus – WordPress Image Optimizer | 41 | 52 | 20 | 30k+ | Unsafe printing function | ||
| #3344 | Passwordless Login | 41 | 40 | 24 | 1k+ | Output is not escaped | ||
| #3345 | المنتور فارسی | 41 | 19 | 54 | 40k+ | Nonce verification recommended | ||
| #3346 | Personalize Login | 41 | 47 | 84 | 500 | Nonce verification recommended | ||
| #3347 | Pods – Custom Content Types and Fields | 41 | 5 | 233 | 100k+ | Direct Query | ||
| #3348 | Web Accessibility (formally known as Ally) – WCAG Scanning, Guided Fixes, Usability Widget | 41 | 47 | 38 | 500k+ | Output is not escaped | ||
| #3349 | Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News | 41 | 537 | 20k+ | Non-prefixed global variable | |||
| #3350 | Post Cloner | 41 | 25 | 15 | 1k+ | Text Domain Mismatch |
