PluginScore

WordPress.Security.NonceVerification.Recommended

Nonce verification recommended

The code reads request data in a place where Plugin Check recommends a nonce check.

critical weight

Why It Shows Up

The scan saw request handling that may not always mutate state, but still looks like a user-triggered action that should usually be protected by a nonce.

Why It Matters

Adding a nonce reduces accidental or forged requests and documents that the action is expected to originate from the plugin UI.

How to Fix

  • For admin forms and action links, add and verify a nonce.
  • For AJAX handlers, use `check_ajax_referer()`.
  • For public read-only endpoints, document why a nonce is not required and keep input validation strict.

References

WordPress nonces

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#401Media Library Assistant231,1313,75970k+Nonce verification recommended
#402MediaPress239045834k+Output is not escaped
#403Order Bump for WooCommerce231,7201,562600Output is not escaped
#404Moloni239013562k+Missing Arg Domain
#405MotoPress Appointment Booking232,3628572k+Text Domain Mismatch
#406Restaurant Menu and Food Ordering233858532k+Non-prefixed global variable
#407MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar234,06548820k+Text Domain Mismatch
#408MStore API – Create Native Android & iOS Apps On The Cloud236187643k+SQL query is not prepared
#409MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO234855802k+Missing nonce verification
#410MyWorks Sync for WooCommerce & QuickBooks Online232,2929,1015k+Non-prefixed global variable
#411ND Shortcodes236212,42620k+Non-prefixed global variable
#412News Kit Addons For Elementor23694194k+Post Not In exclude
#413Simple Newsletter Plugin – Noptin237159310k+Non-prefixed global variable
#414Next Active Directory Integration236832842k+Exception output is not escaped
#415Nirweb support23254617800Request data is not unslashed
#416NitroPack – Performance, Page Speed & Cache Plugin for Core Web Vitals, CDN & Image Optimization2331663990k+Output is not escaped
#417Ocean Extra231,4942,107500k+Non-prefixed global variable
#418Issues and Series for Newspapers, Magazines, Publishers, Writers233467102k+Nonce verification recommended
#419Patchstack – WordPress & Plugins Security2310748950k+Missing nonce verification
#420Photo Gallery by 10Web – Mobile-Friendly Image Gallery234,1591,553100k+Output is not escaped
#421Gallery PhotoBlocks239041,3453k+Non-prefixed global variable
#422ExpressTechSoftwares Discord Add-on for Paid Memberships Pro23454449700Text Domain Mismatch
#423AI Popup231,224636400Text Domain Mismatch
#424Post to Google My Business (Google Business Profile)238451,45210k+Non-prefixed global variable
#425Postie2340825910k+Output is not escaped
#426PowerPress Podcasting plugin by Blubrry234,8152,45220k+Output is not escaped
#427Pricing Table by Supsystic231,29944710k+Non Singular String Literal Domain
#428Primary Addon for Elementor237651,3067k+Non-prefixed global variable
#429Print Anywhere & Create PDFs of Order Receipts, Invoices, Labels & More.231,4854441k+Text Domain Mismatch
#430Print My Blog – Print, PDF, & eBook Converter WordPress Plugin231,0771,6608k+Non-prefixed global variable
#431Protect Admin236061,3002k+Non-prefixed global variable
#432Radio Station by netmix® – Manage and play your Show Schedule in WordPress!239343,6191k+Non-prefixed global variable
#433Read More Without Refresh239551,34720k+Non-prefixed global variable
#434Read More WP235701,3111k+Non-prefixed global variable
#435Real Estate Manager – Property Listing and Agent Management236062,301600Non-prefixed global variable
#436Real 3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder239081,37710k+Non-prefixed global variable
#437Redirection23523457100k+Non-prefixed global variable
#438Request a Quote – Quote Forms for Any WordPress Site232401,099900Non-prefixed hook name
#439Restaurant & Cafe Addon for Elementor238891,3261k+Non-prefixed global variable
#440Revive.so – Bulk Rewrite and Republish Blog Posts23332228700Text Domain Mismatch
#441Robo Gallery – Photo & Image Slider231,29153040k+Output is not escaped
#442Manago AI & Leadoo AI236444291k+Unsafe printing function
#443Schema231,17324540k+Text Domain Mismatch
#444SecuPress with Simple SSL – Simple and Performant Security231,6971,60140k+Non-prefixed global variable
#445Secure Custom Fields232401,37080k+Non-prefixed function
#446SEO Redirection Plugin – 301 Redirect Manager2327272710k+Non-prefixed global variable
#447Seraphinite Post .DOCX Source231,156110900Output is not escaped
#448Seriously Simple Podcasting2354862930k+Non-prefixed hook name
#449Shipment Tracker for Woocommerce234775762k+Missing Arg Domain
#450Local Google Analytics for WordPress – caches external requests235511993k+Output is not escaped