WordPress.Security.NonceVerification.Recommended
Nonce verification recommended
The code reads request data in a place where Plugin Check recommends a nonce check.
Why It Shows Up
The scan saw request handling that may not always mutate state, but still looks like a user-triggered action that should usually be protected by a nonce.
Why It Matters
Adding a nonce reduces accidental or forged requests and documents that the action is expected to originate from the plugin UI.
How to Fix
- For admin forms and action links, add and verify a nonce.
- For AJAX handlers, use `check_ajax_referer()`.
- For public read-only endpoints, document why a nonce is not required and keep input validation strict.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #4051 | More Sorting Options for WooCommerce | 61 | 27 | 17 | 3k+ | Output is not escaped | ||
| #4052 | wp-cleanumlauts2 | 61 | 32 | 22 | 1k+ | Output is not escaped | ||
| #4053 | WP Optin Wheel – Gamified Optin Email Marketing Tool for WordPress and WooCommerce | 61 | 22 | 74 | 1k+ | Non-prefixed global variable | ||
| #4054 | RSS Feed Retriever | 61 | 23 | 8 | 7k+ | wp function not compatible with requires wp | ||
| #4055 | AAM Protected Media Files | 62 | 13 | 10 | 600 | Direct Query | ||
| #4056 | AMP Contact FORM 7 – AMPCF7 | 62 | 9 | 13 | 500 | Input is not validated | ||
| #4057 | AMS Post And Page Duplicator | 62 | 14 | 13 | 600 | Text Domain Mismatch | ||
| #4058 | ARI Fancy Lightbox – Popup for WordPress | 62 | 8 | 107 | 10k+ | Non-prefixed namespace | ||
| #4059 | Bulk edit publish date | 62 | 11 | 16 | 1k+ | Nonce verification recommended | ||
| #4060 | Bulk Page Creator | 62 | 9 | 17 | 10k+ | Request data is not unslashed | ||
| #4061 | Check for Broken Links – Broken Link Checker & 404 Monitor | 62 | 2 | 32 | 600 | Missing nonce verification | ||
| #4062 | Christmas Panda | 62 | 14 | 45 | 400 | Input is not validated | ||
| #4063 | Custom Permalink Editor | 62 | 4 | 51 | 3k+ | Non-prefixed hook name | ||
| #4064 | Custom Sidebars by ProteusThemes | 62 | 17 | 23 | 1k+ | Missing nonce verification | ||
| #4065 | Custom Site Logo | 62 | 26 | 4 | 1k+ | Unsafe printing function | ||
| #4066 | Devices for Elementor | 62 | 22 | 13 | 400 | Output is not escaped | ||
| #4067 | Disable Visual Editor WYSIWYG | 62 | 10 | 12 | 1k+ | Nonce verification recommended | ||
| #4068 | Falcon – WordPress Optimizations & Tweaks | 62 | 47 | 66 | 2k+ | Short PHP open tag found | ||
| #4069 | Genesis Accessible | 62 | 49 | 17 | 500 | Text Domain Mismatch | ||
| #4070 | Get Chat App | 62 | 10 | 62 | 400 | Request data is not unslashed | ||
| #4071 | GetGenie – AI Content Writer with Keyword Research & SEO Tracking | 62 | 13 | 39 | 80k+ | Nonce verification recommended | ||
| #4072 | Import entries for Gravity Forms | 62 | 6 | 26 | 500 | Input is not validated | ||
| #4073 | Cron Jobs | 62 | 21 | 33 | 2k+ | Nonce verification recommended | ||
| #4074 | MainWP Key Maker | 62 | 3 | 35 | 4k+ | Input is not sanitized | ||
| #4075 | Notibar – Notification Bar for WordPress | 62 | 47 | 64 | 8k+ | wp function not compatible with requires wp | ||
| #4076 | Proofreading | 62 | 11 | 74 | 5k+ | Direct Query | ||
| #4077 | Responsive Slider Gallery – Responsive Image Photo Slider | 62 | 32 | 122 | 2k+ | Non-prefixed global variable | ||
| #4078 | Sitewide Notice WP | 62 | 6 | 13 | 3k+ | Output is not escaped | ||
| #4079 | Spam Comments Cleaner | 62 | 14 | 29 | 1k+ | Non-prefixed function | ||
| #4080 | Uber Login Logo | 62 | 16 | 5 | 10k+ | Unsafe printing function | ||
| #4081 | Satispay for WooCommerce | 62 | 19 | 12 | 7k+ | Exception output is not escaped | ||
| #4082 | Embed Videos For Product Image Gallery Using WooCommerce | 62 | 21 | 16 | 400 | Text Domain Mismatch | ||
| #4083 | WP Charts and Graphs – WordPress Chart Plugin | 62 | 8 | 29 | 1k+ | Input is not sanitized | ||
| #4084 | WP Downloader | 62 | 11 | 15 | 2k+ | Output is not escaped | ||
| #4085 | Wp Theme plugin Download | 62 | 11 | 16 | 2k+ | Output is not escaped | ||
| #4086 | XPoster – Share to Bluesky and Mastodon | 62 | 26 | 36 | 10k+ | Missing nonce verification | ||
| #4087 | Automatic Featured Images from Videos | 63 | 13 | 13 | 7k+ | Missing direct file access protection | ||
| #4088 | Categories Images | 63 | 10 | 21 | 50k+ | wp function not compatible with requires wp | ||
| #4089 | Category Sticky Post | 63 | 4 | 24 | 3k+ | Missing nonce verification | ||
| #4090 | Classic Editor and Classic Widgets | 63 | 19 | 41 | 20k+ | Nonce verification recommended | ||
| #4091 | Custom post types, Custom Fields & more | 63 | 101 | 22 | 3k+ | Missing Translators Comment | ||
| #4092 | Email Post Changes | 63 | 43 | 8 | 500 | Missing Arg Domain | ||
| #4093 | Fathom Analytics for WP | 63 | 25 | 15 | 10k+ | Output is not escaped | ||
| #4094 | FeedFocal | 63 | 16 | 6 | 2k+ | Unsafe printing function | ||
| #4095 | Hide Admin Bar From Front End | 63 | 8 | 17 | 1k+ | Input is not validated | ||
| #4096 | Include Klaviyo for Elementor pro | 63 | 60 | 10 | 2k+ | Missing Arg Domain | ||
| #4097 | Mailster Google Analytics | 63 | 26 | 9 | 900 | Output is not escaped | ||
| #4098 | Mantenimiento web | 63 | 49 | 15 | 20k+ | Text Domain Mismatch | ||
| #4099 | Order auto complete for WooCommerce | 63 | 56 | 22 | 1k+ | Text Domain Mismatch | ||
| #4100 | Simple Membership After Login Redirection | 63 | 4 | 24 | 10k+ | Missing nonce verification |
