WordPress.Security.NonceVerification.Recommended
Nonce verification recommended
The code reads request data in a place where Plugin Check recommends a nonce check.
Why It Shows Up
The scan saw request handling that may not always mutate state, but still looks like a user-triggered action that should usually be protected by a nonce.
Why It Matters
Adding a nonce reduces accidental or forged requests and documents that the action is expected to originate from the plugin UI.
How to Fix
- For admin forms and action links, add and verify a nonce.
- For AJAX handlers, use `check_ajax_referer()`.
- For public read-only endpoints, document why a nonce is not required and keep input validation strict.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #3851 | Weight Based Shipping for WooCommerce | 53 | 48 | 41 | 60k+ | Missing direct file access protection | ||
| #3852 | Ultimate Gift Cards for WooCommerce | 53 | 4 | 450 | 7k+ | Non-prefixed global variable | ||
| #3853 | WP Login Logo | 53 | 28 | 9 | 500 | Unsafe printing function | ||
| #3854 | AffiliateWP – Order Details For Affiliates | 54 | 62 | 27 | 2k+ | Output is not escaped | ||
| #3855 | Analytics Head | 54 | 34 | 7 | 600 | Output is not escaped | ||
| #3856 | Better Admin Bar | 54 | 27 | 63 | 3k+ | Non-prefixed global variable | ||
| #3857 | Booking Calendar | 54 | 28 | 88 | 50k+ | Mixed line endings | ||
| #3858 | Custom Category Templates | 54 | 11 | 11 | 3k+ | Unsafe printing function | ||
| #3859 | Discount Rules for WooCommerce – Disco | Dynamic Pricing, Conditions, Bulk, Bundle, BOGO | 54 | 1 | 61 | 2k+ | Request data is not unslashed | ||
| #3860 | Disqus Comment System | 54 | 17 | 33 | 40k+ | Non-prefixed hook name | ||
| #3861 | Easy Elementor Addons – Addons Pack for Elementor Page Builder | 54 | 35 | 68 | 1k+ | Post Not In exclude | ||
| #3862 | Easy Font Resize | 54 | 33 | 6 | 700 | Setting is missing a sanitization callback | ||
| #3863 | Extended User Search In WP-Admin | 54 | 14 | 17 | 1k+ | SQL query is not prepared | ||
| #3864 | F4 Media Taxonomies | 54 | 7 | 39 | 1k+ | Input is not sanitized | ||
| #3865 | Helpie FAQ — Accordion, Docs & Knowledge Base | 54 | 96 | 89 | 9k+ | Nonce verification recommended | ||
| #3866 | PWA — easy way to Progressive Web App | 54 | 15 | 44 | 2k+ | Dynamic hook name | ||
| #3867 | Juiz Lang Attribute | 54 | 26 | 27 | 2k+ | Text Domain Mismatch | ||
| #3868 | Live Summary for Gravity Forms | 54 | 15 | 27 | 1k+ | Nonce verification recommended | ||
| #3869 | MSN Partner Hub | 54 | 21 | 25 | 1k+ | Missing direct file access protection | ||
| #3870 | Quick Buy Now Button for WooCommerce | 54 | 136 | 25 | 40k+ | Text Domain Mismatch | ||
| #3871 | Reorder Terms | 54 | 17 | 38 | 1k+ | Nonce verification recommended | ||
| #3872 | Resize images before upload | 54 | 19 | 5 | 1k+ | Output is not escaped | ||
| #3873 | REST XML-RPC Data Checker | 54 | 14 | 45 | 900 | Input is not sanitized | ||
| #3874 | AI Agent by SiteGround | 54 | 28 | 6 | 1m+ | Exception output is not escaped | ||
| #3875 | Simple XML Sitemap Generator | 54 | 8 | 28 | 3k+ | Non-prefixed function | ||
| #3876 | SimplyBook.me – Booking and reservations calendar | 54 | 31 | 13 | 30k+ | Exception output is not escaped | ||
| #3877 | SpeedSize Image & Video AI-Optimizer | 54 | 98 | 17 | 400 | Text Domain Mismatch | ||
| #3878 | WC Duplicate Order | 54 | 12 | 15 | 500 | Nonce verification recommended | ||
| #3879 | WPC Order Notes for WooCommerce | 54 | 20 | 25 | 900 | Output is not escaped | ||
| #3880 | WP Menu Icons | 54 | 68 | 52 | 20k+ | Text Domain Mismatch | ||
| #3881 | YITH Proteo Toolkit | 54 | 130 | 64 | 1k+ | Text Domain Mismatch | ||
| #3882 | Accordions | 55 | 1 | 101 | 20k+ | slow db query meta query | ||
| #3883 | Advanced Custom Order Status for WooCommerce | 55 | 44 | 33 | 500 | Text Domain Mismatch | ||
| #3884 | AI Assistant for Elementor – Auto Content Writer, OpenAI, ChatGPT | 55 | 151 | 24 | 400 | Text Domain Mismatch | ||
| #3885 | Quick Buy Now Button for WooCommerce | 55 | 37 | 39 | 5k+ | Output is not escaped | ||
| #3886 | Chabok | چابک | 55 | 16 | 31 | 400 | Nonce verification recommended | ||
| #3887 | Custom Upload Dir | 55 | 63 | 7 | 5k+ | Missing Arg Domain | ||
| #3888 | Disable Feeds | 55 | 9 | 9 | 20k+ | Output is not escaped | ||
| #3889 | Easy Quotes | 55 | 11 | 31 | 700 | Direct Query | ||
| #3890 | Email Template Customizer for WooCommerce | 55 | 552 | 248 | 20k+ | Text Domain Mismatch | ||
| #3891 | Enhanced Category Pages | 55 | 23 | 25 | 2k+ | Direct Query | ||
| #3892 | Feedbucket – Website Feedback Tool | 55 | 10 | 25 | 1k+ | Input is not validated | ||
| #3893 | Gutenify – Visual Site Builder Blocks & Site Templates | 55 | 66 | 40 | 5k+ | Missing Arg Domain | ||
| #3894 | Head Meta Data | 55 | 19 | 42 | 10k+ | Non-prefixed function | ||
| #3895 | Head, Footer and Post Injections | 55 | 9 | 52 | 200k+ | Non-prefixed global variable | ||
| #3896 | JetWidgets For Elementor | 55 | 99 | 279 | 10k+ | Non-prefixed global variable | ||
| #3897 | Landingi Landing Pages | 55 | 18 | 23 | 2k+ | Input is not sanitized | ||
| #3898 | Login or Logout Menu Item | 55 | 13 | 7 | 20k+ | Unsafe printing function | ||
| #3899 | LoginPress | wp-login Custom Login Page Customizer | 55 | 125 | 308 | 200k+ | Non-prefixed function | ||
| #3900 | LexonRank: AI Link Building, Free Backlinks & SEO Automation | 55 | 15 | 20 | 1k+ | Nonce verification recommended |
