WordPress.Security.NonceVerification.Recommended
Nonce verification recommended
The code reads request data in a place where Plugin Check recommends a nonce check.
Why It Shows Up
The scan saw request handling that may not always mutate state, but still looks like a user-triggered action that should usually be protected by a nonce.
Why It Matters
Adding a nonce reduces accidental or forged requests and documents that the action is expected to originate from the plugin UI.
How to Fix
- For admin forms and action links, add and verify a nonce.
- For AJAX handlers, use `check_ajax_referer()`.
- For public read-only endpoints, document why a nonce is not required and keep input validation strict.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #4351 | Hide Categories and Products for Woocommerce | 75 | 1 | 20 | 10k+ | Input is not sanitized | ||
| #4352 | Intuitive Custom Post Order | 75 | 19 | 96 | 400k+ | Direct Query | ||
| #4353 | Invoice Gateway for WooCommerce – Invoice Payment Gateway | 75 | 3 | 30 | 2k+ | Nonce verification recommended | ||
| #4354 | Media Search Enhanced | 75 | 4 | 23 | 4k+ | Non-prefixed hook name | ||
| #4355 | WowOptin: Next-Gen Popup Maker – Create Stunning Popups and Optins for Lead Generation | 75 | 2 | 60 | 1k+ | Database parameter is not escaped | ||
| #4356 | Options Framework | 75 | 8 | 56 | 10k+ | Non-prefixed function | ||
| #4357 | Order Delivery Date And Time | 75 | 26 | 28 | 1k+ | Text Domain Mismatch | ||
| #4358 | OXY Re-Login Window | 75 | 5 | 7 | 500 | Missing Version | ||
| #4359 | PJ News Ticker | 75 | 13 | 14 | 3k+ | Output is not escaped | ||
| #4360 | Post Type Switcher | 75 | 3 | 18 | 200k+ | Direct Query | ||
| #4361 | Rapyd Payment Extension for WooCommerce | 75 | 50 | 33 | 400 | Text Domain Mismatch | ||
| #4362 | Logos Reftagger | 75 | 12 | 15 | 10k+ | Deprecated parameter: add_option parameter 3 | ||
| #4363 | Checkout & Store Toolkit for WooCommerce | 75 | 21 | 900 | Nonce verification recommended | |||
| #4364 | Services Section Block – Showcase Service Details in Grid or Columns | 75 | 9 | 19 | 2k+ | Non-prefixed namespace | ||
| #4365 | Styled Calendar – Customizable, Mobile Responsive Google Calendar Embeds | 75 | 8 | 8 | 1k+ | Exception output is not escaped | ||
| #4366 | Temporary Login | 75 | 3 | 25 | 40k+ | Nonce verification recommended | ||
| #4367 | True Lazy Analytics | 75 | 11 | 13 | 6k+ | Nonce verification recommended | ||
| #4368 | UK Address Postcode Validation | 75 | 72 | 33 | 700 | Non Singular String Literal Domain | ||
| #4369 | Video Background Block – Use video as background in section. | 75 | 35 | 90 | 2k+ | Non-prefixed global variable | ||
| #4370 | Extra Product Sorting Options for WooCommerce | 75 | 10 | 16 | 10k+ | Text Domain Mismatch | ||
| #4371 | wp-forecast | 75 | 263 | 117 | 5k+ | Missing Arg Domain | ||
| #4372 | YITH Slider for page builders | 75 | 13 | 22 | 1k+ | Nonce verification recommended | ||
| #4373 | Advanced Image Gallery for Elementor – Grid, Carousel & Slideshow | 76 | 3 | 226 | 400 | Non-prefixed global variable | ||
| #4374 | Auction Nudge – Your eBay Listings | 76 | 18 | 6 | 1k+ | Missing direct file access protection | ||
| #4375 | Autocomplete WooCommerce Orders | 76 | 70 | 55 | 30k+ | Text Domain Mismatch | ||
| #4376 | Cache External Scripts | 76 | 21 | 4 | 900 | Output is not escaped | ||
| #4377 | PiWeb Cancel order / Refund request for WooCommerce | 76 | 40 | 49 | 2k+ | wp function not compatible with requires wp | ||
| #4378 | Clear Cache Everywhere | 76 | 7 | 17 | 700 | Nonce verification recommended | ||
| #4379 | Custom Template for LearnDash | 76 | 7 | 9 | 1k+ | Non-prefixed hook name | ||
| #4380 | Dicode Icons Pack | 76 | 10 | 13 | 600 | Nonce verification recommended | ||
| #4381 | Drip for WordPress | 76 | 11 | 7 | 2k+ | Missing direct file access protection | ||
| #4382 | Like Thumbnail | 76 | 13 | 8 | 1k+ | Output is not escaped | ||
| #4383 | FileBird Document Library | 76 | 23 | 13 | 5k+ | Text Domain Mismatch | ||
| #4384 | Form to Chat App ⚡️ | 76 | 4 | 13 | 2k+ | Nonce verification recommended | ||
| #4385 | Input Masks for Contact Form 7 | 76 | 143 | 12 | 800 | wp function not compatible with requires wp | ||
| #4386 | Leo Product Recommendations for WooCommerce | 76 | 3 | 79 | 400 | Short URL found | ||
| #4387 | Admin Bookmarks | 76 | 30 | 4 | 500 | Text Domain Mismatch | ||
| #4388 | ABC Crypto Checkout | 76 | 42 | 14 | 1k+ | Text Domain Mismatch | ||
| #4389 | Rearrange Products for WooCommerce | 76 | 1 | 22 | 20k+ | Input is not sanitized | ||
| #4390 | Search Regex | 76 | 6 | 25 | 100k+ | Direct Query | ||
| #4391 | Siteready Coming Soon Under Construction | 76 | 6 | 30 | 3k+ | Non-prefixed global variable | ||
| #4392 | Store file uploads for Contact Form 7 | 76 | 5 | 6 | 1k+ | Output is not escaped | ||
| #4393 | TagPages | 76 | 13 | 4 | 1k+ | Missing Arg Domain | ||
| #4394 | The Future Is Now | 76 | 3 | 10 | 1k+ | Input is not sanitized | ||
| #4395 | WEN Featured Image | 76 | 1 | 18 | 3k+ | Input is not validated | ||
| #4396 | Pelecard Gateway | 76 | 295 | 54 | 400 | Text Domain Mismatch | ||
| #4397 | WP SAML Auth | 76 | 7 | 25 | 7k+ | Nonce verification recommended | ||
| #4398 | WPC Free Gift Coupons for WooCommerce | 76 | 4 | 19 | 400 | Non-prefixed class | ||
| #4399 | Before After Image Comparison – Visual Comparison for Two Images | 77 | 18 | 16 | 3k+ | Text Domain Mismatch | ||
| #4400 | Contact Form 7 Translate Messages Extension | 77 | 10 | 5 | 1k+ | Output is not escaped |
