WordPress.Security.NonceVerification.Recommended
Nonce verification recommended
The code reads request data in a place where Plugin Check recommends a nonce check.
Why It Shows Up
The scan saw request handling that may not always mutate state, but still looks like a user-triggered action that should usually be protected by a nonce.
Why It Matters
Adding a nonce reduces accidental or forged requests and documents that the action is expected to originate from the plugin UI.
How to Fix
- For admin forms and action links, add and verify a nonce.
- For AJAX handlers, use `check_ajax_referer()`.
- For public read-only endpoints, document why a nonce is not required and keep input validation strict.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #4201 | Booter – Bots & Crawlers Manager | 68 | 81 | 7k+ | Non-prefixed global variable | |||
| #4202 | Category Featured Images | 68 | 5 | 12 | 600 | Input is not sanitized | ||
| #4203 | ConvertBox Auto Embed WordPress plugin | 68 | 18 | 10 | 5k+ | Missing direct file access protection | ||
| #4204 | Default Attributes for WooCommerce | 68 | 22 | 18 | 400 | Non-prefixed hook name | ||
| #4205 | Desert Companion | 68 | 412 | 837 | 20k+ | Non-prefixed global variable | ||
| #4206 | Exchange Rates Today | 68 | 9 | 10 | 400 | Non-prefixed function | ||
| #4207 | Export media with selected content (by DKZR) | 68 | 10 | 14 | 40k+ | Direct Query | ||
| #4208 | Free Assets Library – Openverse/Pixabay 600+ Million Images | 68 | 44 | 36 | 4k+ | Text Domain Mismatch | ||
| #4209 | WCAG 2.0 form fields for Gravity Forms | 68 | 11 | 13 | 5k+ | Output is not escaped | ||
| #4210 | My Social Feeds – Social Feeds Embedder Plugin for WP | 68 | 1 | 30 | 400 | Nonce verification recommended | ||
| #4211 | Custom Form Builder, Contact Forms, Payment Forms, Surveys, Polls | 68 | 21 | 18 | 900 | Output is not escaped | ||
| #4212 | Russian Post and EMS for WooCommerce | 68 | 16 | 47 | 1k+ | Non-prefixed global variable | ||
| #4213 | Series | 68 | 55 | 6 | 2k+ | Text Domain Mismatch | ||
| #4214 | SKT Page Builder | 68 | 15 | 49 | 2k+ | Missing nonce verification | ||
| #4215 | Slim Maintenance Mode | 68 | 9 | 10 | 10k+ | Output is not escaped | ||
| #4216 | Smartarget – Chat Buttons & Engagement Apps | 68 | 31 | 11 | 1k+ | Non Singular String Literal Domain | ||
| #4217 | Sortable Word Count Reloaded | 68 | 18 | 6 | 2k+ | Output is not escaped | ||
| #4218 | Increase Maximum Upload File Size | 68 | 28 | 14 | 40k+ | Missing Arg Domain | ||
| #4219 | WiserReview Product Reviews for WooCommerce | 68 | 21 | 110 | 900 | Non-prefixed global variable | ||
| #4220 | WP Theme Changelogs | 68 | 13 | 18 | 900 | Nonce verification recommended | ||
| #4221 | WP User Avatars | 68 | 5 | 20 | 20k+ | Input is not sanitized | ||
| #4222 | Black Bar | 69 | 78 | 39 | 500 | Short PHP open tag found | ||
| #4223 | Chatway Live Chat – AI Chatbot, Customer Support, FAQ & Helpdesk Customer Service & Chat Buttons | 69 | 22 | 24 | 30k+ | Text Domain Mismatch | ||
| #4224 | Contact Form 7 | 69 | 56 | 39 | 10m+ | Missing direct file access protection | ||
| #4225 | Contact Form 7: Accessible Defaults | 69 | 3 | 28 | 5k+ | Nonce verification recommended | ||
| #4226 | CryptX | 69 | 11 | 30 | 10k+ | Missing nonce verification | ||
| #4227 | Custom Login URL | 69 | 16 | 17 | 1k+ | Missing Arg Domain | ||
| #4228 | Debug | 69 | 25 | 34 | 2k+ | Input is not sanitized | ||
| #4229 | Disable Users | 69 | 11 | 9 | 2k+ | Text Domain Mismatch | ||
| #4230 | Easy Auto Reload – Auto Refresh | 69 | 37 | 12 | 1k+ | Text Domain Mismatch | ||
| #4231 | ELEX WooCommerce Bulk Edit Products, Prices & Attributes (Basic) | 69 | 511 | 51 | 4k+ | Text Domain Mismatch | ||
| #4232 | ELEX WooCommerce Discount Per Payment Method | 69 | 60 | 39 | 1k+ | Text Domain Mismatch | ||
| #4233 | GDPR Compliance for Mailchimp | 69 | 7 | 15 | 2k+ | Missing nonce verification | ||
| #4234 | GZSEO | 69 | 3 | 66 | 400 | Direct Query | ||
| #4235 | 简数采集器 | 69 | 5 | 25 | 1k+ | Request data is not unslashed | ||
| #4236 | Media Slider for Photos Images Videos | 69 | 10 | 23 | 2k+ | Missing Version | ||
| #4237 | Payment Gateway for PhonePe and for Woocommerce | 69 | 15 | 14 | 900 | Non Singular String Literal Domain | ||
| #4238 | PDF.js Viewer | 69 | 14 | 38 | 20k+ | Non-prefixed global variable | ||
| #4239 | Post Featured Video | 69 | 4 | 15 | 900 | Missing nonce verification | ||
| #4240 | PrivacyBee – Datenschutz im Autopilot | 69 | 19 | 27 | 600 | Non-prefixed global variable | ||
| #4241 | Rename Taxonomies by WebMan | 69 | 32 | 7 | 1k+ | Missing Arg Domain | ||
| #4242 | Shoppable Social Media Galleries by Sauce | 69 | 13 | 13 | 2k+ | Non-prefixed function | ||
| #4243 | Simple YouTube Embed | 69 | 11 | 11 | 5k+ | Nonce verification recommended | ||
| #4244 | Sticky Header Effects for Elementor | 69 | 354 | 71 | 300k+ | Text Domain Mismatch | ||
| #4245 | Easy Username Updater | 69 | 19 | 28 | 10k+ | Missing Arg Domain | ||
| #4246 | WC Variations Radio Buttons | 69 | 12 | 21 | 3k+ | Non-prefixed global variable | ||
| #4247 | WP Disable Automatic Updates | 69 | 14 | 8 | 2k+ | Output is not escaped | ||
| #4248 | Animentor – Lottie & Bodymovin for Elementor | 70 | 18 | 8 | 4k+ | Output is not escaped | ||
| #4249 | AppScenic – Smart AI Dropshipping | 70 | 16 | 41 | 3k+ | Dynamic hook name | ||
| #4250 | BestPrice Analytics Integration | 70 | 35 | 10 | 1k+ | Text Domain Mismatch |
