WordPress.Security.NonceVerification.Recommended
Nonce verification recommended
The code reads request data in a place where Plugin Check recommends a nonce check.
Why It Shows Up
The scan saw request handling that may not always mutate state, but still looks like a user-triggered action that should usually be protected by a nonce.
Why It Matters
Adding a nonce reduces accidental or forged requests and documents that the action is expected to originate from the plugin UI.
How to Fix
- For admin forms and action links, add and verify a nonce.
- For AJAX handlers, use `check_ajax_referer()`.
- For public read-only endpoints, document why a nonce is not required and keep input validation strict.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #3951 | JSON API User | 57 | 17 | 34 | 1k+ | Non-prefixed hook name | ||
| #3952 | Logo Manager For Enamad – لوگوی نماد الکترونیکی | 57 | 18 | 14 | 5k+ | Output is not escaped | ||
| #3953 | MC4WP: Mailchimp for WordPress | 57 | 238 | 1m+ | Non-prefixed global variable | |||
| #3954 | Monri Payments | 57 | 141 | 47 | 900 | Text Domain Mismatch | ||
| #3955 | Protected Posts Logout Button | 57 | 10 | 20 | 1k+ | Input is not sanitized | ||
| #3956 | Public Post Preview | 57 | 8 | 11 | 100k+ | Nonce verification recommended | ||
| #3957 | Search Exclude | 57 | 73 | 40 | 50k+ | Text Domain Mismatch | ||
| #3958 | WC Call For Price | 57 | 19 | 55 | 1k+ | Non-prefixed global variable | ||
| #3959 | Filter Orders by Product for WooCommerce | 57 | 9 | 21 | 4k+ | Nonce verification recommended | ||
| #3960 | Sequential Order Numbers for WooCommerce | 57 | 9 | 24 | 10k+ | Interpolated SQL is not prepared | ||
| #3961 | WP Table Builder – Drag & Drop Table Builder | 57 | 63 | 39 | 50k+ | Not Allowed | ||
| #3962 | XML Feed for Skroutz & BestPrice for WooCommerce | 57 | 12 | 50 | 600 | Input is not sanitized | ||
| #3963 | Zoho Billing – Embed Payment Form | 57 | 22 | 10 | 400 | Output is not escaped | ||
| #3964 | Web Accessibility Toolkit – Accessibility Checker & ARIA for WCAG, Section 508 & ADA Compliance | 58 | 9 | 20 | 500 | Output is not escaped | ||
| #3965 | BCM Duplicate Menu | 58 | 8 | 11 | 4k+ | Nonce verification recommended | ||
| #3966 | Debloat – Remove Unused CSS, Optimize JS | 58 | 24 | 20 | 30k+ | Nonce verification recommended | ||
| #3967 | Departamentos y Ciudades de Colombia para Woocommerce | 58 | 49 | 42 | 6k+ | Text Domain Mismatch | ||
| #3968 | Error Log Viewer by BestWebSoft | 58 | 433 | 172 | 6k+ | Text Domain Mismatch | ||
| #3969 | Go Redirects URL Forwarder | 58 | 17 | 14 | 1k+ | Output is not escaped | ||
| #3970 | Gutenverse Form – Contact Form Builder, Block Form & Booking Form | 58 | 17 | 48 | 10k+ | Nonce verification recommended | ||
| #3971 | Houzez WooCommerce Addon | 58 | 22 | 21 | 4k+ | Missing Translators Comment | ||
| #3972 | License For Envato | 58 | 12 | 31 | 9k+ | Non-prefixed global variable | ||
| #3973 | Nginx Cache | 58 | 12 | 8 | 10k+ | Unsafe printing function | ||
| #3974 | WP Online Active Users | 58 | 26 | 45 | 2k+ | Non-prefixed global variable | ||
| #3975 | Quickcreator – AI Blog Writer | 58 | 14 | 18 | 500 | Exception output is not escaped | ||
| #3976 | REVIEWS.io for WooCommerce | 58 | 71 | 161 | 1k+ | Non-prefixed global variable | ||
| #3977 | Rewrite Rules Inspector | 58 | 7 | 59 | 10k+ | Nonce verification recommended | ||
| #3978 | SportsPress for Basketball | 58 | 104 | 34 | 1k+ | Text Domain Mismatch | ||
| #3979 | SportsPress for Football (Soccer) | 58 | 107 | 34 | 6k+ | Text Domain Mismatch | ||
| #3980 | SportsPress for Volleyball | 58 | 107 | 34 | 500 | Text Domain Mismatch | ||
| #3981 | Ultimate Member – Online Users | 58 | 25 | 4 | 3k+ | Output is not escaped | ||
| #3982 | Videopack | 58 | 28 | 108 | 10k+ | Input is not sanitized | ||
| #3983 | View Admin As | 58 | 307 | 135 | 9k+ | Non Singular String Literal Domain | ||
| #3984 | Cloak Affiliate Links for WooCommerce | 58 | 28 | 6 | 2k+ | Non Singular String Literal Domain | ||
| #3985 | Blog Designer | 59 | 62 | 83 | 10k+ | Text Domain Mismatch | ||
| #3986 | Posts Order | 59 | 59 | 20 | 1k+ | Text Domain Mismatch | ||
| #3987 | Co-Authors Plus | 59 | 2 | 76 | 20k+ | Input is not sanitized | ||
| #3988 | Cresta Posts Box | 59 | 10 | 13 | 1k+ | Output is not escaped | ||
| #3989 | Disabled Source, Disabled Right Click and Content Protection | 59 | 6 | 33 | 10k+ | Nonce verification recommended | ||
| #3990 | Display Post Types – Post Grid, post list and post sliders | 59 | 24 | 14 | 7k+ | Output is not escaped | ||
| #3991 | Fathom Analytics Conversions | 59 | 14 | 47 | 400 | Non-prefixed function | ||
| #3992 | File Upload For WPForms – Filenzo | 59 | 8 | 16 | 1k+ | Output is not escaped | ||
| #3993 | flowpaper | 59 | 13 | 31 | 10k+ | Non-prefixed function | ||
| #3994 | Gettext override translations | 59 | 33 | 7 | 2k+ | Missing Arg Domain | ||
| #3995 | Getty Images | 59 | 11 | 46 | 2k+ | Missing nonce verification | ||
| #3996 | Gravity Forms: Notification Attachments | 59 | 18 | 7 | 500 | Output is not escaped | ||
| #3997 | GravityWP – Merge Tags | 59 | 16 | 172 | 2k+ | Non-prefixed global variable | ||
| #3998 | HTTP Headers | 59 | 20 | 43 | 50k+ | Nonce verification recommended | ||
| #3999 | Importify – AI Dropshipping for WooCommerce | 59 | 22 | 71 | 2k+ | Non-prefixed global variable | ||
| #4000 | MapGeo – Interactive Geo Maps | 59 | 14 | 51 | 40k+ | Non-prefixed hook name |
