WordPress.Security.NonceVerification.Recommended
Nonce verification recommended
The code reads request data in a place where Plugin Check recommends a nonce check.
Why It Shows Up
The scan saw request handling that may not always mutate state, but still looks like a user-triggered action that should usually be protected by a nonce.
Why It Matters
Adding a nonce reduces accidental or forged requests and documents that the action is expected to originate from the plugin UI.
How to Fix
- For admin forms and action links, add and verify a nonce.
- For AJAX handlers, use `check_ajax_referer()`.
- For public read-only endpoints, document why a nonce is not required and keep input validation strict.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #3651 | Updater by BestWebSoft | 46 | 494 | 219 | 2k+ | Text Domain Mismatch | ||
| #3652 | URL Params | 46 | 36 | 17 | 8k+ | Text Domain Mismatch | ||
| #3653 | WEN Logo Slider | 46 | 6 | 46 | 1k+ | Non-prefixed global variable | ||
| #3654 | Custom Price Labels for WooCommerce | 46 | 17 | 22 | 1k+ | Output is not escaped | ||
| #3655 | WPB Category Slider for WooCommerce – Responsive Product Category Carousel & Enhanced UX | 46 | 101 | 16 | 700 | Non Singular String Literal Domain | ||
| #3656 | WP All Import – Import SEO Settings for Yoast SEO | 46 | 19 | 26 | 20k+ | Nonce verification recommended | ||
| #3657 | Auto Focus Keyword for SEO | 47 | 13 | 44 | 2k+ | Interpolated SQL is not prepared | ||
| #3658 | Avacy CMP | 47 | 5 | 90 | 500 | Non-prefixed global variable | ||
| #3659 | Verified Member for BuddyPress | 47 | 20 | 38 | 3k+ | Nonce verification recommended | ||
| #3660 | 404 Image Redirection (Replace Broken Images) | 47 | 118 | 85 | 600 | Text Domain Mismatch | ||
| #3661 | Cashfree for WooCommerce | 47 | 21 | 21 | 8k+ | Nonce verification recommended | ||
| #3662 | Better Badge – Custom Product Badges for WooCommerce | 47 | 22 | 47 | 500 | Non Singular String Literal Domain | ||
| #3663 | Customizer Export/Import | 47 | 14 | 15 | 100k+ | Unsafe printing function | ||
| #3664 | DPO Pay for WooCommerce | 47 | 28 | 41 | 1k+ | Non Singular String Literal Text | ||
| #3665 | Extended CRM for Users Insights | 47 | 11 | 23 | 400 | Missing nonce verification | ||
| #3666 | Flying Pages: Preload Pages for Faster Navigation & Improved User Experience | 47 | 21 | 21 | 20k+ | Missing direct file access protection | ||
| #3667 | Gateway AqayePardakht for Woocommerce | 47 | 72 | 23 | 4k+ | Text Domain Mismatch | ||
| #3668 | Groups 404 Redirect | 47 | 35 | 33 | 1k+ | Non Singular String Literal Domain | ||
| #3669 | Import Users from CSV | 47 | 33 | 12 | 10k+ | Unsafe printing function | ||
| #3670 | Log Emails | 47 | 19 | 29 | 6k+ | Non-prefixed global variable | ||
| #3671 | Real Media Library: Media Library Folder & File Manager | 47 | 1 | 365 | 100k+ | Direct Query | ||
| #3672 | Restore PayPal Standard for WooCommerce | 47 | 19 | 53 | 3k+ | Nonce verification recommended | ||
| #3673 | Simple Custom Post Order | 47 | 9 | 76 | 300k+ | Direct Query | ||
| #3674 | SportsPress for Baseball | 47 | 113 | 34 | 900 | Text Domain Mismatch | ||
| #3675 | Tabby Checkout | 47 | 33 | 46 | 4k+ | Non-prefixed class | ||
| #3676 | Simple Client Dashboard | 47 | 38 | 36 | 2k+ | Missing direct file access protection | ||
| #3677 | Better Usability for WooCommerce | 47 | 30 | 93 | 800 | Non-prefixed hook name | ||
| #3678 | iControlWP | 47 | 45 | 59 | 1k+ | Missing direct file access protection | ||
| #3679 | 3CX Free Live Chat, Calls & Messaging | 47 | 24 | 16 | 100k+ | Output is not escaped | ||
| #3680 | WP PHP Console | 47 | 18 | 24 | 500 | Output is not escaped | ||
| #3681 | QuadLayers TikTok Feed | 47 | 78 | 52 | 7k+ | Text Domain Mismatch | ||
| #3682 | WP User Profile Restriction | 47 | 26 | 8 | 400 | Output is not escaped | ||
| #3683 | Compress, Resize & Lazy Load Images – WPvivid Image Optimization | 47 | 107 | 58 | 10k+ | Missing direct file access protection | ||
| #3684 | XML Sitemap & Google News | 47 | 270 | 224 | 100k+ | Non-prefixed global variable | ||
| #3685 | Add Polylang support for Customizer | 48 | 18 | 20 | 2k+ | Nonce verification recommended | ||
| #3686 | Ansar Import – One Click Starter Sites – for Elementor & Themes | 48 | 27 | 116 | 10k+ | Non-prefixed global variable | ||
| #3687 | Better Block Patterns | 48 | 77 | 11 | 1k+ | Missing direct file access protection | ||
| #3688 | Comment Notifier | 48 | 10 | 55 | 400 | Non-prefixed global variable | ||
| #3689 | CookieFox – Cookie Notice | 48 | 14 | 19 | 400 | Output is not escaped | ||
| #3690 | Current Menu Item for Custom Post Types | 48 | 18 | 30 | 2k+ | Non-prefixed global variable | ||
| #3691 | Filter Page by Template | 48 | 17 | 20 | 2k+ | Nonce verification recommended | ||
| #3692 | Fixed And Sticky Header | 48 | 31 | 7 | 1k+ | Output is not escaped | ||
| #3693 | Maps Plugin using Google Maps for WordPress – WP Google Map | 48 | 289 | 38 | 10k+ | wp function not compatible with requires wp | ||
| #3694 | Hotline Phone Ring | 48 | 16 | 15 | 8k+ | Output is not escaped | ||
| #3695 | JW Player for WordPress | 48 | 288 | 78 | 1k+ | Text Domain Mismatch | ||
| #3696 | Library Bookshelves | 48 | 12 | 59 | 500 | Nonce verification recommended | ||
| #3697 | Mailster Live | 48 | 22 | 37 | 600 | Missing Translators Comment | ||
| #3698 | Optinly – Exit Intent, Newsletter Popups, Gamification & Opt-in Forms | 48 | 34 | 14 | 800 | Non Singular String Literal Domain | ||
| #3699 | Raw HTML Snippets | 48 | 14 | 36 | 2k+ | Input is not sanitized | ||
| #3700 | Simple Regenerate Slug | 48 | 18 | 6 | 400 | Unsafe printing function |
