WordPress.Security.NonceVerification.Recommended
Nonce verification recommended
The code reads request data in a place where Plugin Check recommends a nonce check.
Why It Shows Up
The scan saw request handling that may not always mutate state, but still looks like a user-triggered action that should usually be protected by a nonce.
Why It Matters
Adding a nonce reduces accidental or forged requests and documents that the action is expected to originate from the plugin UI.
How to Fix
- For admin forms and action links, add and verify a nonce.
- For AJAX handlers, use `check_ajax_referer()`.
- For public read-only endpoints, document why a nonce is not required and keep input validation strict.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #3601 | Ajax Archive Calendar | 45 | 40 | 18 | 1k+ | date date | ||
| #3602 | Back In Stock Notifier for WooCommerce | WooCommerce Waitlist Pro | 45 | 26 | 117 | 20k+ | Non-prefixed hook name | ||
| #3603 | Contact Form 7 Signature Addon | 45 | 147 | 44 | 6k+ | Text Domain Mismatch | ||
| #3604 | Content Copy Protection & Disable Right Click | 45 | 47 | 17 | 1k+ | Output is not escaped | ||
| #3605 | Hyper Cache | 45 | 36 | 100 | 8k+ | Non-prefixed global variable | ||
| #3606 | Evergreen Countdown Timer | 45 | 193 | 35 | 2k+ | wp function not compatible with requires wp | ||
| #3607 | JetHost Total Care – Security & Enhancements | 45 | 10 | 85 | 800 | Direct Query | ||
| #3608 | LWS Hide Login | 45 | 5 | 58 | 20k+ | Request data is not unslashed | ||
| #3609 | New Order Notification for WooCommerce | 45 | 21 | 42 | 900 | Output is not escaped | ||
| #3610 | Outdooractive Embed | 45 | 70 | 18 | 400 | Text Domain Mismatch | ||
| #3611 | Passwords Evolved | 45 | 26 | 17 | 1k+ | Output is not escaped | ||
| #3612 | Popup Box – Easily Create WordPress Popups | 45 | 7 | 151 | 7k+ | Non-prefixed global variable | ||
| #3613 | Product Visibility by User Role for WooCommerce | 45 | 36 | 35 | 6k+ | Missing Translators Comment | ||
| #3614 | Quick Interest Slider | 45 | 1 | 46 | 1k+ | Missing nonce verification | ||
| #3615 | Related Posts By PickPlugins | 45 | 4 | 84 | 3k+ | Non-prefixed global variable | ||
| #3616 | ShayanWeb Admin FontChanger | افزونهی تغییر فونت پیشخوان وردپرس شایان وب | 45 | 42 | 8 | 1k+ | Output is not escaped | ||
| #3617 | Simple Login Notification | 45 | 13 | 22 | 2k+ | Request data is not unslashed | ||
| #3618 | Slider Templates | 45 | 10 | 33 | 1k+ | Request data is not unslashed | ||
| #3619 | Utimate Kit ( Styler ) for WPForms | 45 | 240 | 69 | 20k+ | Missing Arg Domain | ||
| #3620 | SyntaxHighlighter Evolved | 45 | 33 | 46 | 20k+ | Not In Footer | ||
| #3621 | TriPay Payment Gateway | 45 | 478 | 44 | 1k+ | Text Domain Mismatch | ||
| #3622 | VietQR | 45 | 32 | 39 | 4k+ | Text Domain Mismatch | ||
| #3623 | Payrexx Payment Gateway for WooCommerce | 45 | 18 | 117 | 2k+ | Non-prefixed class | ||
| #3624 | WP OpenAPI | 45 | 26 | 22 | 400 | Output is not escaped | ||
| #3625 | WP Revisions Manager | 45 | 47 | 19 | 700 | Non Singular String Literal Domain | ||
| #3626 | ARI Stream Quiz – WordPress Quizzes Builder | 46 | 21 | 239 | 2k+ | Non-prefixed global variable | ||
| #3627 | Batch Comment Spam Deletion | 46 | 22 | 15 | 1k+ | Nonce verification recommended | ||
| #3628 | Better image sizes | 46 | 45 | 23 | 2k+ | Text Domain Mismatch | ||
| #3629 | Bullhorn Career Portal WordPress Plugin | 46 | 46 | 7 | 1k+ | Output is not escaped | ||
| #3630 | CDEKDelivery | 46 | 75 | 2k+ | Nonce verification recommended | |||
| #3631 | Official CleverReach® Plugin for WooCommerce | 46 | 37 | 98 | 400 | Non-prefixed global variable | ||
| #3632 | CLP Varnish Cache | 46 | 15 | 58 | 10k+ | Non-prefixed global variable | ||
| #3633 | CoSchedule | 46 | 24 | 66 | 3k+ | Nonce verification recommended | ||
| #3634 | DarkMySite – Advanced Dark Mode Plugin for WordPress | 46 | 22 | 100 | 1k+ | Request data is not unslashed | ||
| #3635 | Display Featured Image for Genesis | 46 | 64 | 59 | 1k+ | Non-prefixed global variable | ||
| #3636 | DX Delete Attached Media | 46 | 32 | 8 | 4k+ | Output is not escaped | ||
| #3637 | Easy Subscribe | 46 | 132 | 800 | Direct Query | |||
| #3638 | Export Import Menus | 46 | 23 | 28 | 10k+ | Missing nonce verification | ||
| #3639 | Gravity Forms Constant Contact | 46 | 36 | 27 | 3k+ | Non-prefixed class | ||
| #3640 | Import Social Events | 46 | 26 | 355 | 3k+ | Non-prefixed global variable | ||
| #3641 | Live Copy Paste for Elementor – Cross Domain Copy Paste & Page Duplicator | 46 | 13 | 25 | 7k+ | Request data is not unslashed | ||
| #3642 | Material Design Icons for Page Builders | 46 | 69 | 46 | 20k+ | Missing direct file access protection | ||
| #3643 | Podcast Player – Your Podcasting Companion | 46 | 14 | 133 | 10k+ | Non-prefixed global variable | ||
| #3644 | PickPlugins Product Designer for WooCommerce | 46 | 14 | 123 | 500 | Missing nonce verification | ||
| #3645 | Repeater Fields for Gravity Forms | 46 | 134 | 41 | 1k+ | wp function not compatible with requires wp | ||
| #3646 | Simple Sitemap – Create a Responsive HTML Sitemap | 46 | 33 | 48 | 60k+ | Non-prefixed hook name | ||
| #3647 | Link in Bio Creator – Social | 46 | 52 | 36 | 2k+ | Non Singular String Literal Domain | ||
| #3648 | Stars Rating | 46 | 13 | 34 | 1k+ | Missing nonce verification | ||
| #3649 | StockPack – Stock photos from Unsplash, Adobe Stock and more | 46 | 35 | 51 | 6k+ | Nonce verification recommended | ||
| #3650 | Ultimate FAQ Solution | 46 | 285 | 97 | 600 | Text Domain Mismatch |
