WordPress.Security.NonceVerification.Recommended
Nonce verification recommended
The code reads request data in a place where Plugin Check recommends a nonce check.
Why It Shows Up
The scan saw request handling that may not always mutate state, but still looks like a user-triggered action that should usually be protected by a nonce.
Why It Matters
Adding a nonce reduces accidental or forged requests and documents that the action is expected to originate from the plugin UI.
How to Fix
- For admin forms and action links, add and verify a nonce.
- For AJAX handlers, use `check_ajax_referer()`.
- For public read-only endpoints, document why a nonce is not required and keep input validation strict.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #4401 | Contact Form 7 Translate Messages Extension | 77 | 10 | 5 | 1k+ | Output is not escaped | ||
| #4402 | CodeKit – Custom Codes Editor | 77 | 11 | 29 | 5k+ | Non-prefixed global variable | ||
| #4403 | Custom HTML Block Extension | 77 | 8 | 13 | 7k+ | Missing direct file access protection | ||
| #4404 | Disable Toolbar | 77 | 6 | 3 | 1k+ | Output is not escaped | ||
| #4405 | Disable WP Registration Page Spam | 77 | 5 | 12 | 1k+ | Nonce verification recommended | ||
| #4406 | Dual Currency Display | 77 | 1 | 24 | 900 | Direct Query | ||
| #4407 | easypay Gateway Checkout for WooCommerce | 77 | 6 | 42 | 600 | Nonce verification recommended | ||
| #4408 | eSewa – Nepal First Payment Gateway | 77 | 48 | 9 | 600 | Text Domain Mismatch | ||
| #4409 | Floating Contact Button | 77 | 6 | 3 | 1k+ | Output is not escaped | ||
| #4410 | WP-FormAssembly | 77 | 4 | 15 | 2k+ | Nonce verification recommended | ||
| #4411 | Embed Files from Google Drive | 77 | 4 | 35 | 5k+ | Nonce verification recommended | ||
| #4412 | Photo & Video Gallery – Image, Video & Portfolio | 77 | 4 | 10 | 1k+ | Missing Version | ||
| #4413 | Pushover Integration for WooCommerce | 77 | 107 | 7 | 800 | Text Domain Mismatch | ||
| #4414 | Self-Hosted Google Fonts | 77 | 35 | 11 | 30k+ | Text Domain Mismatch | ||
| #4415 | SendPulse Email Marketing Newsletter | 77 | 8 | 7 | 1k+ | Output is not escaped | ||
| #4416 | Shipping Zone Duplicator for WooCommerce | 77 | 10 | 14 | 800 | Nonce verification recommended | ||
| #4417 | Display custom fields in the frontend – Post and User Profile Fields | 77 | 17 | 18 | 600 | Non-prefixed global variable | ||
| #4418 | Table Of Contents Block | 77 | 15 | 8 | 10k+ | wp function not compatible with requires wp | ||
| #4419 | Tagembed Social Feeds Widget | 77 | 21 | 137 | 10k+ | Non-prefixed function | ||
| #4420 | Taggbox – Free Social Media Widgets, Review Badges & Shoppable UGC | 77 | 23 | 113 | 1k+ | Direct Query | ||
| #4421 | Template Kit – Import | 77 | 41 | 60 | 400k+ | Non-prefixed global variable | ||
| #4422 | Unattach | 77 | 4 | 11 | 900 | Nonce verification recommended | ||
| #4423 | Album Photostream Flickr Gallery | 77 | 30 | 31 | 1k+ | Text Domain Mismatch | ||
| #4424 | Lorem Ipsum Generator | 77 | 7 | 9 | 500 | Missing direct file access protection | ||
| #4425 | WPC Show Single Variations for WooCommerce | 77 | 1 | 26 | 1k+ | Nonce verification recommended | ||
| #4426 | ELEX WooCommerce Address Validation & Google Address Autocomplete Plugin | 78 | 73 | 40 | 700 | Missing Arg Domain | ||
| #4427 | Instant AI Image Generator – Create & Import Images | 78 | 23 | 1k+ | Non-prefixed constant | |||
| #4428 | Animated Text Block – Add Typing and Looping Text Effects | 78 | 5 | 25 | 4k+ | Non-prefixed class | ||
| #4429 | Booking System Trafft | 78 | 3 | 19 | 400 | Nonce verification recommended | ||
| #4430 | Bookvault | 78 | 13 | 10 | 700 | Nonce verification recommended | ||
| #4431 | Claspo – Popups, Spin the Wheel & Email Capture | 78 | 107 | 16 | 1k+ | wp function not compatible with requires wp | ||
| #4432 | Code Block Syntax Highlighter for Elementor | 78 | 344 | 3 | 600 | Non Singular String Literal Domain | ||
| #4433 | Player for SoundCloud – Embed and Play Audio Tracks | 78 | 17 | 24 | 1k+ | Text Domain Mismatch | ||
| #4434 | Image Alt Text | 78 | 5 | 19 | 9k+ | Nonce verification recommended | ||
| #4435 | Layouts for Elementor | 78 | 27 | 1k+ | Non-prefixed global variable | |||
| #4436 | Layouts for WPBakery | 78 | 28 | 3k+ | Non-prefixed global variable | |||
| #4437 | Maintenance Notice | 78 | 26 | 71 | 800 | Non-prefixed global variable | ||
| #4438 | Media Focus Point | 78 | 11 | 6 | 6k+ | Output is not escaped | ||
| #4439 | Nav Menu Images | 78 | 5 | 8 | 6k+ | Missing nonce verification | ||
| #4440 | Album Gallery for Photo & Video | 78 | 7 | 8 | 4k+ | wp function not compatible with requires wp | ||
| #4441 | Coming Soon & Maintenance Mode Page & Under Construction | 78 | 35 | 67 | 10k+ | Non-prefixed global variable | ||
| #4442 | One Time Login | 78 | 7 | 8 | 40k+ | Nonce verification recommended | ||
| #4443 | PatternsWP – Gutenberg Block Patterns & Page Templates Library | 78 | 1 | 25 | 500 | Non-prefixed constant | ||
| #4444 | PiWeb Min/Max Quantity & Minimum Order Limits for WooCommerce | 78 | 41 | 700 | Nonce verification recommended | |||
| #4445 | Post Order By Category | 78 | 1 | 12 | 900 | Missing nonce verification | ||
| #4446 | Post slider elementor addons | 78 | 168 | 13 | 2k+ | Text Domain Mismatch | ||
| #4447 | PrettyPhoto – Simple Lightbox Plugin | 78 | 25 | 12 | 2k+ | Non Singular String Literal Domain | ||
| #4448 | Resend Welcome Email | 78 | 5 | 9 | 1k+ | Nonce verification recommended | ||
| #4449 | Animator – Scroll Triggered Animations | 78 | 16 | 24 | 1k+ | Missing direct file access protection | ||
| #4450 | SearchWP Live Ajax Search | 78 | 8 | 23 | 50k+ | Non-prefixed global variable |
