PluginScore

WordPress.Security.NonceVerification.Recommended

Nonce verification recommended

The code reads request data in a place where Plugin Check recommends a nonce check.

critical weight

Why It Shows Up

The scan saw request handling that may not always mutate state, but still looks like a user-triggered action that should usually be protected by a nonce.

Why It Matters

Adding a nonce reduces accidental or forged requests and documents that the action is expected to originate from the plugin UI.

How to Fix

  • For admin forms and action links, add and verify a nonce.
  • For AJAX handlers, use `check_ajax_referer()`.
  • For public read-only endpoints, document why a nonce is not required and keep input validation strict.

References

WordPress nonces

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#3751Sitemap Generator5060263k+Output is not escaped
#3752Pago por Redsys504459700Text Domain Mismatch
#3753PostmagThemes Demo Import501911141k+Text Domain Mismatch
#3754Product Open Pricing (Name Your Price) for WooCommerce50105376k+Text Domain Mismatch
#3755Razorpay Payment Links for WooCommerce5016341k+Nonce verification recommended
#3756Section Widget502435500Nonce verification recommended
#3757Send Emails with Mandrill50361416k+Non-prefixed global variable
#3758Server Info – System Health & Diagnostics Suite5015463k+Input is not sanitized
#3759Simple User Listing502756900Non-prefixed global variable
#3760Sözleşmeler506361k+Input is not sanitized
#3761Table Addons for Elementor50922920k+wp function not compatible with requires wp
#3762BestWebSoft's Twitter50477174900Text Domain Mismatch
#3763Ultimate Floating Widgets – Make popup sidebars5048143k+Output is not escaped
#3764Ultimate WooCommerce Brands508712400Text Domain Mismatch
#3765User Activity Tracking and Log50302632k+Non-prefixed global variable
#3766Calculadora de Frete e Campos Checkout para o Brasil5011385k+Missing nonce verification
#3767WP Hide Show Featured Image503654k+Unsafe printing function
#3768WRC Pricing Tables – Responsive CSS3 Pricing Tables505962k+Missing nonce verification
#3769Cart Popup for WooCommerce5191159k+Non-prefixed global variable
#3770Address Geocoder511218500Output is not escaped
#3771Adjust Admin Categories51301210k+Output is not escaped
#3772AVIF Uploader5149444k+Missing Arg Domain
#3773Feeds for TikTok – Display Video Feeds in Grid Layouts5118591k+Request data is not unslashed
#3774Bootstrap Modals514381k+Output is not escaped
#3775Category Archive Widget51542700Output is not escaped
#3776Counter Box – Add Countdowns, Timers & Dynamic Counters to WordPress5131161k+Missing nonce verification
#3777Custom Post Type UI5116401m+Non-prefixed hook name
#3778Dynamic Pricing and Discount Rules5124651k+Non Singular String Literal Text
#3779Dolyame Payment gateway5112210700Text Domain Mismatch
#3780Easy Search Replace – Find & Replace Text/HTML/URLs, Remove Footer Credit51661500Input is not sanitized
#3781Gravatar Enhanced – Avatars, Profiles, and Privacy513848100k+Dynamic hook name
#3782Gutenverse – WordPress Blocks, Page Builder & Site Editor51174720k+Non-prefixed hook name
#3783Interactive Globes – 3D World Maps5124104400Non-prefixed global variable
#3784Juicer.io: Effortlessly embed, curate, and aggregate social media feeds into your website5144349k+Output is not escaped
#3785Menu Icons by Themeisle – Add Icons to Navigation Menus513422100k+Output is not escaped
#3786Mintpay511435600Nonce verification recommended
#3787OnSale Page for WooCommerce5130442k+Text Domain Mismatch
#3788POLi Payments for WooCommerce516226500Text Domain Mismatch
#3789Quotes and Tips by BestWebSoft514851901k+Text Domain Mismatch
#3790SePay Gateway5112391k+Nonce verification recommended
#3791Popular Brand Icons – Simple Icons5120123k+Output is not escaped
#3792StoryChief5112551k+Input is not sanitized
#3793The Cache Purger5116161k+Non Singular String Literal Text
#3794Trustpilot Reviews51145230k+Missing nonce verification
#3795Visual Sitemap51236400Output is not escaped
#3796VK Filter Search5135716k+Nonce verification recommended
#3797Payment Gateway Payoneer For WooCommerce51935900Input is not validated
#3798Swift SMTP (formerly Welcome Email Editor)5112627k+Missing nonce verification
#3799WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System5122385k+Output is not escaped
#3800WP Counter Up – Animated Number Counter & Milestone Showcase51182391k+Non-prefixed global variable