WordPress.Security.NonceVerification.Recommended
Nonce verification recommended
The code reads request data in a place where Plugin Check recommends a nonce check.
Why It Shows Up
The scan saw request handling that may not always mutate state, but still looks like a user-triggered action that should usually be protected by a nonce.
Why It Matters
Adding a nonce reduces accidental or forged requests and documents that the action is expected to originate from the plugin UI.
How to Fix
- For admin forms and action links, add and verify a nonce.
- For AJAX handlers, use `check_ajax_referer()`.
- For public read-only endpoints, document why a nonce is not required and keep input validation strict.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #3901 | Marvy – Background Animations for Elementor | 55 | 63 | 34 | 4k+ | Text Domain Mismatch | ||
| #3902 | Quick and Easy Testimonials | 55 | 62 | 32 | 3k+ | Non Singular String Literal Domain | ||
| #3903 | Slider Block by Sliderberg – WordPress Slider & Carousel Plugin for Gutenberg | 55 | 23 | 19 | 1k+ | Output is not escaped | ||
| #3904 | Free customer chat solution | 55 | 18 | 10 | 500 | Output is not escaped | ||
| #3905 | Themeflection Numbers – Number Counter and Animated Numbers | 55 | 224 | 73 | 3k+ | Text Domain Mismatch | ||
| #3906 | Trusona for WordPress | 55 | 8 | 34 | 500 | Non-prefixed function | ||
| #3907 | VS Contact Form | 55 | 3 | 318 | 7k+ | Non-prefixed global variable | ||
| #3908 | VK Block Patterns | 55 | 8 | 61 | 100k+ | Non-prefixed function | ||
| #3909 | AAArdvark Accessibility Reports | 55 | 62 | 42 | 700 | Non-prefixed global variable | ||
| #3910 | Payment Integration Wompi – El Salvador | 55 | 50 | 27 | 800 | Text Domain Mismatch | ||
| #3911 | Insert Headers And Footers | 55 | 74 | 275 | 300k+ | Non-prefixed function | ||
| #3912 | WP Ultimate Review | 55 | 23 | 381 | 70k+ | Non-prefixed global variable | ||
| #3913 | Yext Plugin | 55 | 16 | 23 | 800 | Non-prefixed function | ||
| #3914 | AI Copilot – ChatGPT Chatbot & AI Engine for Post Automation | 56 | 65 | 20 | 1k+ | Text Domain Mismatch | ||
| #3915 | BuddyCommerce: WooCommerce and BuddyPress Integration | 56 | 29 | 19 | 800 | Output is not escaped | ||
| #3916 | SMTP by BestWebSoft | 56 | 486 | 175 | 1k+ | Text Domain Mismatch | ||
| #3917 | CHEQ Essentials | 56 | 14 | 49 | 700 | Request data is not unslashed | ||
| #3918 | FluentSnippets – High-Performance Code Snippets, Header & Footer Code, Custom CSS & PHP Code Manager | 56 | 31 | 27 | 50k+ | Nonce verification recommended | ||
| #3919 | Easy Digital Downloads Featured Downloads | 56 | 15 | 15 | 1k+ | Output is not escaped | ||
| #3920 | Fluent Connect – Connect ThriveCart with your WordPress and FluentCRM | 56 | 37 | 54 | 600 | curl curl setopt | ||
| #3921 | Grids: Layout builder for WordPress | 56 | 24 | 27 | 2k+ | Missing direct file access protection | ||
| #3922 | Karma Music Player by Kadar | 56 | 47 | 9 | 700 | Output is not escaped | ||
| #3923 | Form data to kintone | 56 | 25 | 22 | 1k+ | Output is not escaped | ||
| #3924 | CIELO API PIX, credit card, debit payment for WooCommerce | 56 | 11 | 121 | 700 | Nonce verification recommended | ||
| #3925 | MAS Brands for WooCommerce | 56 | 80 | 15 | 10k+ | Text Domain Mismatch | ||
| #3926 | Maya Business Plugin | 56 | 9 | 39 | 600 | Input is not validated | ||
| #3927 | PuzzleMe – Interactive Puzzles for WordPress – Easily publish crosswords, quizzes, word searches and more | 56 | 36 | 15 | 1k+ | Output is not escaped | ||
| #3928 | Require Featured Image | 56 | 20 | 6 | 3k+ | Output is not escaped | ||
| #3929 | Review Stream | 56 | 41 | 42 | 400 | Non-prefixed global variable | ||
| #3930 | Image Optimization For SEO | 56 | 116 | 69 | 3k+ | Non Singular String Literal Domain | ||
| #3931 | Simple Org Chart | 56 | 15 | 29 | 900 | Missing Version | ||
| #3932 | Simple Social Media Share Buttons – Social Sharing for Everyone | 56 | 145 | 22 | 20k+ | Text Domain Mismatch | ||
| #3933 | Smooth Back To Top Button | 56 | 41 | 7 | 40k+ | Output is not escaped | ||
| #3934 | Subscriptions for WooCommerce with Stripe Recurring Payments | 56 | 10 | 467 | 800 | Non-prefixed global variable | ||
| #3935 | TableKit – WordPress Table Builder for Data Tables, WooCommerce Product Tables & Post Tables | 56 | 80 | 20 | 3k+ | Missing Translators Comment | ||
| #3936 | TextBuilder | 56 | 20 | 34 | 4k+ | Missing Arg Domain | ||
| #3937 | ThemeinWP Import Companion | 56 | 17 | 14 | 4k+ | Unsafe printing function | ||
| #3938 | Export & Import WPBakery Page Builder | 56 | 12 | 20 | 9k+ | Missing nonce verification | ||
| #3939 | WC Moneris Payment Gateway | 56 | 82 | 20 | 900 | Text Domain Mismatch | ||
| #3940 | easy AMP | 56 | 10 | 24 | 600 | Input is not sanitized | ||
| #3941 | WP Clean Admin Menu | 56 | 29 | 11 | 2k+ | Output is not escaped | ||
| #3942 | Social Chat – Click To Chat App Button | 56 | 81 | 45 | 200k+ | Text Domain Mismatch | ||
| #3943 | Pantheon Migrations | 57 | 15 | 26 | 1k+ | Output is not escaped | ||
| #3944 | BestWebSoft’s Pinterest | 57 | 490 | 176 | 500 | Text Domain Mismatch | ||
| #3945 | Cresta Social Share Counter | 57 | 12 | 13 | 2k+ | Output is not escaped | ||
| #3946 | Disable Cart Fragments by Optimocha | 57 | 8 | 13 | 10k+ | Nonce verification recommended | ||
| #3947 | Easy GDPR Consent Forms – MailChimp | 57 | 72 | 22 | 500 | Text Domain Mismatch | ||
| #3948 | Live Chat by Formilla – Real-time Chat & Chatbots Plugin | 57 | 22 | 13 | 2k+ | Missing Arg Domain | ||
| #3949 | iConvert Promoter | 57 | 98 | 217 | 2k+ | Non-prefixed global variable | ||
| #3950 | Jquery Validation For Contact Form 7 | 57 | 16 | 19 | 9k+ | Missing direct file access protection |
