WordPress.Security.NonceVerification.Recommended
Nonce verification recommended
The code reads request data in a place where Plugin Check recommends a nonce check.
Why It Shows Up
The scan saw request handling that may not always mutate state, but still looks like a user-triggered action that should usually be protected by a nonce.
Why It Matters
Adding a nonce reduces accidental or forged requests and documents that the action is expected to originate from the plugin UI.
How to Fix
- For admin forms and action links, add and verify a nonce.
- For AJAX handlers, use `check_ajax_referer()`.
- For public read-only endpoints, document why a nonce is not required and keep input validation strict.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #4251 | Comment Form Js Validation | 70 | 23 | 8 | 2k+ | Missing Arg Domain | ||
| #4252 | WebDefender Security – Protection & AntiSpam | 70 | 176 | 61 | 1k+ | wp function not compatible with requires wp | ||
| #4253 | Yoast Duplicate Post | 70 | 8 | 88 | 4m+ | Nonce verification recommended | ||
| #4254 | fitness calculators | 70 | 94 | 25 | 600 | Missing Arg Domain | ||
| #4255 | Free Gift Product For WooCommerce | 70 | 9 | 77 | 800 | Non-prefixed global variable | ||
| #4256 | Ghost | 70 | 25 | 12 | 600 | Output is not escaped | ||
| #4257 | Host Header Injection Fix | 70 | 9 | 8 | 400 | Output is not escaped | ||
| #4258 | Xpro Slider For Beaver Builder – Lite | 70 | 147 | 13 | 500 | Text Domain Mismatch | ||
| #4259 | Shipping Notices and No shipping options found info for WooCommerce | 70 | 9 | 18 | 400 | Non-prefixed global variable | ||
| #4260 | onepay Payment Gateway For WooCommerce | 70 | 49 | 13 | 900 | Text Domain Mismatch | ||
| #4261 | PipraPay Gateway | 70 | 11 | 6 | 400 | Output is not escaped | ||
| #4262 | Portfolio Post Type | 70 | 7 | 11 | 50k+ | Nonce verification recommended | ||
| #4263 | Post Grid & Post Slider – Carousel, Filter Tabs & Related Posts | 70 | 6 | 53 | 1k+ | Request data is not unslashed | ||
| #4264 | Purchased Items Column for WooCommerce Orders | 70 | 10 | 8 | 800 | Output is not escaped | ||
| #4265 | Show-Hide / Collapse-Expand | 70 | 18 | 15 | 10k+ | Missing direct file access protection | ||
| #4266 | Spocket ‑ US & EU Dropshipping | 70 | 15 | 31 | 1k+ | Direct Query | ||
| #4267 | Upsell Funnel Builder for WooCommerce – Create Upsells, Cross-Sells, Order Bumps, Frequently Bought, and Popups. | 70 | 3 | 1,446 | 3k+ | Non-prefixed global variable | ||
| #4268 | WEBKINDER Integration for Google Analytics and Google Tag Manager | 70 | 15 | 22 | 10k+ | Output is not escaped | ||
| #4269 | Quick Buy For Woocommerce | 70 | 105 | 22 | 1k+ | Text Domain Mismatch | ||
| #4270 | Yampi Checkout | 70 | 6 | 10 | 900 | Nonce verification recommended | ||
| #4271 | aapanel WP Toolkit | 71 | 20 | 18 | 2k+ | wp function not compatible with requires wp | ||
| #4272 | ACF Tooltip | 71 | 16 | 3 | 1k+ | Output is not escaped | ||
| #4273 | Add Any Extension to Pages | 71 | 3 | 10 | 2k+ | Input is not sanitized | ||
| #4274 | Another Mailchimp Widget | 71 | 28 | 17 | 4k+ | Missing Translators Comment | ||
| #4275 | Bold Timeline Lite | 71 | 220 | 561 | 10k+ | Non-prefixed global variable | ||
| #4276 | Event SEO: Event Schema / Structured Data: Google Rich Snippet Schema for Event | 71 | 24 | 49 | 700 | Non-prefixed global variable | ||
| #4277 | Link Checker Pro | 71 | 6 | 25 | 4k+ | Non-prefixed function | ||
| #4278 | Nginx Helper | 71 | 47 | 60 | 200k+ | Non-prefixed global variable | ||
| #4279 | Repeater Fields for WPForms | 71 | 173 | 18 | 500 | wp function not compatible with requires wp | ||
| #4280 | SmartSMTP | 71 | 8 | 42 | 2k+ | Nonce verification recommended | ||
| #4281 | Tax Switch for WooCommerce | 71 | 3 | 20 | 900 | Non-prefixed hook name | ||
| #4282 | Webhook for Discord | 71 | 119 | 20 | 400 | Text Domain Mismatch | ||
| #4283 | WooCommerce Shipping | 71 | 48 | 70k+ | Direct Query | |||
| #4284 | WP 4 Me Title Remover | 71 | 17 | 13 | 1k+ | Missing direct file access protection | ||
| #4285 | Multi-Step Checkout for WooCommerce | 71 | 38 | 104 | 8k+ | Non-prefixed global variable | ||
| #4286 | Web Accessibility by accessiBe | 72 | 1 | 25 | 10k+ | Input is not sanitized | ||
| #4287 | Amazing Affiliates – Toolkit for Amazon Associates with Amazon Product Blocks and Amazon PAAPI5 / Creators API integration | 72 | 3 | 650 | 600 | Non-prefixed global variable | ||
| #4288 | BB Delete cache | 72 | 3 | 15 | 1k+ | Input is not sanitized | ||
| #4289 | Discontinued Product Stock Status for WooCommerce | 72 | 1 | 51 | 500 | Missing nonce verification | ||
| #4290 | PowerBI Embed Reports | 72 | 3 | 20 | 500 | Nonce verification recommended | ||
| #4291 | Getsitecontrol — Email Marketing Plugin | Popup Maker, Automations & Newsletters | 72 | 17 | 11 | 1k+ | wp function not compatible with requires wp | ||
| #4292 | Gift Wrapping for WooCommerce | 72 | 2 | 16 | 1k+ | Missing nonce verification | ||
| #4293 | jQuery Masonry Image Gallery | 72 | 17 | 6 | 1k+ | Unsafe printing function | ||
| #4294 | Minimal Maintenance Mode | 72 | 1 | 20 | 600 | Missing nonce verification | ||
| #4295 | Non-Purchasable WooCommerce Products | 72 | 14 | 13 | 1k+ | Input is not validated | ||
| #4296 | Responsive Blocks – Page Builder for Blocks & Patterns | 72 | 47 | 43 | 3k+ | badly named files | ||
| #4297 | Responsive Owl Carousel for Elementor | 72 | 40 | 89 | 7k+ | Non-prefixed global variable | ||
| #4298 | Advanced Datepicker – Restricts Date for Contact Form 7 | 72 | 228 | 11 | 400 | wp function not compatible with requires wp | ||
| #4299 | Shipping Rate By Cities | 72 | 4 | 21 | 700 | Direct Query | ||
| #4300 | Ultimate Member Custom Tab Builder Lite | 72 | 12 | 15 | 500 | Output is not escaped |
