WordPress.Security.NonceVerification.Recommended
Nonce verification recommended
The code reads request data in a place where Plugin Check recommends a nonce check.
Why It Shows Up
The scan saw request handling that may not always mutate state, but still looks like a user-triggered action that should usually be protected by a nonce.
Why It Matters
Adding a nonce reduces accidental or forged requests and documents that the action is expected to originate from the plugin UI.
How to Fix
- For admin forms and action links, add and verify a nonce.
- For AJAX handlers, use `check_ajax_referer()`.
- For public read-only endpoints, document why a nonce is not required and keep input validation strict.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #4001 | JetSticky For Elementor | 59 | 13 | 38 | 30k+ | Nonce verification recommended | ||
| #4002 | Lazy Loader | 59 | 6 | 24 | 9k+ | Nonce verification recommended | ||
| #4003 | Pattern Wrangler – Manage Block Patterns and Pattern Categories | 59 | 14 | 73 | 400 | Non-prefixed global variable | ||
| #4004 | SureFeedback Client Site | 59 | 47 | 24 | 5k+ | Text Domain Mismatch | ||
| #4005 | Remove Add to Cart Button for WooCommerce | 59 | 115 | 18 | 500 | Text Domain Mismatch | ||
| #4006 | Side Menu Lite – Sticky Floating Side Menu | 59 | 9 | 123 | 7k+ | Non-prefixed global variable | ||
| #4007 | Subscribers – Free Web Push Notifications | 59 | 15 | 11 | 1k+ | Output is not escaped | ||
| #4008 | Videojs HTML5 Player | 59 | 12 | 12 | 8k+ | Nonce verification recommended | ||
| #4009 | Konnect Payment Gateway for WooCommerce | 59 | 39 | 16 | 400 | Text Domain Mismatch | ||
| #4010 | WC Korkmaz Contract – Contracts for WooCommerce | 59 | 7 | 38 | 500 | Non-prefixed global variable | ||
| #4011 | Payment Gateway for LiqPay for Woocommerce | 59 | 84 | 31 | 1k+ | Text Domain Mismatch | ||
| #4012 | Variation Swatches for WooCommerce | 59 | 11 | 64 | 300k+ | Non-prefixed global variable | ||
| #4013 | RevivePress – Keep your Old Content Evergreen | 59 | 27 | 46 | 5k+ | date date | ||
| #4014 | WPML Widgets | 59 | 9 | 9 | 9k+ | Unsafe printing function | ||
| #4015 | Admin Menu Groups | 60 | 26 | 10 | 800 | Output is not escaped | ||
| #4016 | Post Blocks & Tools | 60 | 9 | 46 | 400 | Missing nonce verification | ||
| #4017 | FancyBox for WordPress | 60 | 175 | 33 | 30k+ | Text Domain Mismatch | ||
| #4018 | HelloAsso | 60 | 132 | 89 | 4k+ | Short PHP open tag found | ||
| #4019 | Just Responsive Images | 60 | 25 | 7 | 500 | Missing direct file access protection | ||
| #4020 | Mailster AmazonSES Integration | 60 | 52 | 25 | 1k+ | Missing Arg Domain | ||
| #4021 | Post Duplicator | 60 | 33 | 24 | 200k+ | Missing direct file access protection | ||
| #4022 | RealHomes PayPal Payments | 60 | 55 | 23 | 400 | Non Singular String Literal Domain | ||
| #4023 | Skyboot Custom Icons for Elementor – Elementor Icons library – 14300+ Icons | 60 | 91 | 9 | 200k+ | Text Domain Mismatch | ||
| #4024 | Stratum Widgets for Elementor | 60 | 66 | 366 | 20k+ | Non-prefixed global variable | ||
| #4025 | Tabby Responsive Tabs | 60 | 16 | 5 | 10k+ | Output is not escaped | ||
| #4026 | MultiStep Checkout for WooCommerce | 60 | 46 | 57 | 4k+ | Non Singular String Literal Text | ||
| #4027 | WoowGallery | 60 | 15 | 178 | 1k+ | Non-prefixed global variable | ||
| #4028 | WPSSO Schema Product Metadata for WooCommerce | 60 | 33 | 23 | 500 | Missing Translators Comment | ||
| #4029 | Ads.txt Manager | 61 | 33 | 16 | 4k+ | Text Domain Mismatch | ||
| #4030 | Comment Form WP – Customize Default Comment Form | 61 | 39 | 7 | 600 | Output is not escaped | ||
| #4031 | CommerceBird – AI Command Center, ERP Integrations & B2B for WooCommerce (Zoho, Exact Online). | 61 | 2 | 162 | 400 | Direct Query | ||
| #4032 | Compact WP Audio Player | 61 | 12 | 21 | 20k+ | Non-prefixed function | ||
| #4033 | ELEX WooCommerce Catalog Mode | 61 | 97 | 49 | 10k+ | Text Domain Mismatch | ||
| #4034 | Country and State Selection Addon for Gravity Forms | 61 | 14 | 26 | 1k+ | Non-prefixed constant | ||
| #4035 | GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor | 61 | 9 | 119 | 80k+ | Non-prefixed global variable | ||
| #4036 | Hotjar | 61 | 16 | 4 | 70k+ | Output is not escaped | ||
| #4037 | Magic Tooltips For Contact Form 7 | 61 | 37 | 21 | 700 | Text Domain Mismatch | ||
| #4038 | Mentions Legales Par Webdeclic | 61 | 82 | 39 | 500 | Non Singular String Literal Domain | ||
| #4039 | Reorder Posts – Quick Post Type and Page Ordering | 61 | 10 | 23 | 10k+ | Request data is not unslashed | ||
| #4040 | Order On Mobile for WooCommerce | 61 | 37 | 15 | 2k+ | Text Domain Mismatch | ||
| #4041 | Post/Page Import Export – Migrate Content with Custom Fields & Taxonomies | 61 | 12 | 27 | 400 | Input is not sanitized | ||
| #4042 | Powerkit – Supercharge your WordPress Site | 61 | 67 | 116 | 10k+ | Non-prefixed global variable | ||
| #4043 | PW WooCommerce Copy Coupon | 61 | 15 | 17 | 1k+ | Text Domain Mismatch | ||
| #4044 | Qikink Print On Demand and DropShipping | 61 | 14 | 23 | 1k+ | Input is not validated | ||
| #4045 | SEOPress for MainWP | 61 | 240 | 106 | 900 | Text Domain Mismatch | ||
| #4046 | Simple User Avatar | 61 | 8 | 14 | 20k+ | Output is not escaped | ||
| #4047 | Slider Factory | 61 | 3 | 414 | 2k+ | Non-prefixed global variable | ||
| #4048 | Two Factor (2FA) Authentication via Email | 61 | 12 | 27 | 9k+ | Request data is not unslashed | ||
| #4049 | Order Weight for WooCommerce | 61 | 24 | 34 | 600 | Text Domain Mismatch | ||
| #4050 | QR Code PicPay for WooCommerce | 61 | 15 | 25 | 600 | Non-prefixed global variable |
