WordPress.Security.NonceVerification.Recommended
Nonce verification recommended
The code reads request data in a place where Plugin Check recommends a nonce check.
Why It Shows Up
The scan saw request handling that may not always mutate state, but still looks like a user-triggered action that should usually be protected by a nonce.
Why It Matters
Adding a nonce reduces accidental or forged requests and documents that the action is expected to originate from the plugin UI.
How to Fix
- For admin forms and action links, add and verify a nonce.
- For AJAX handlers, use `check_ajax_referer()`.
- For public read-only endpoints, document why a nonce is not required and keep input validation strict.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #4451 | Spider Blocker | 78 | 19 | 9 | 20k+ | Missing Translators Comment | ||
| #4452 | Tock Widget | 78 | 6 | 9 | 400 | Missing direct file access protection | ||
| #4453 | Wisepops Popups & Notifications | 78 | 15 | 500 | Nonce verification recommended | |||
| #4454 | WP Faster | 78 | 7 | 12 | 1k+ | trademarked term | ||
| #4455 | Blocks for Products | 79 | 18 | 13 | 400 | Non Singular String Literal Domain | ||
| #4456 | Boxzilla – WordPress Popup Builder | 79 | 4 | 64 | 20k+ | Non-prefixed global variable | ||
| #4457 | Click To Copy – Copy Text or Code to Clipboard Instantly | 79 | 9 | 8 | 900 | Text Domain Mismatch | ||
| #4458 | Contact Form 7 Get and Show Parameter from URL | 79 | 3 | 10 | 800 | Input is not sanitized | ||
| #4459 | JSON API Auth | 79 | 5 | 11 | 700 | Non-prefixed function | ||
| #4460 | Klaviyo | 79 | 26 | 86 | 100k+ | Non-prefixed function | ||
| #4461 | Location Weather – WordPress Weather Forecast, Air Quality & Weather Widget | 79 | 567 | 10k+ | Non-prefixed global variable | |||
| #4462 | تقویم فارسی – Persian Calendar | 79 | 2 | 8 | 2k+ | Nonce verification recommended | ||
| #4463 | Real Category Management: Content Management in Category Folders | 79 | 4 | 73 | 2k+ | Non-prefixed constant | ||
| #4464 | Retainful – WooCommerce Abandoned Cart, Newsletters, Email Marketing, Signup Forms and Automation | 79 | 15 | 26 | 1k+ | Non-prefixed hook name | ||
| #4465 | Rox Appointment Booking – Appointment Booking Scheduling Solution | 79 | 4 | 15 | 1k+ | Database parameter is not escaped | ||
| #4466 | Testimonial Customer Feedback | 79 | 3 | 6 | 1k+ | Nonce verification recommended | ||
| #4467 | WP Last Modified Info | 79 | 45 | 32 | 40k+ | Short PHP open tag found | ||
| #4468 | WP Map Block – Gutenberg Map Block for Google Map and OpenStreet Map by aBlocks | 79 | 6 | 10 | 20k+ | trademarked term | ||
| #4469 | New Relic Reporting for WordPress | 79 | 4 | 16 | 600 | Nonce verification recommended | ||
| #4470 | Antispam Bee | 80 | 4 | 38 | 700k+ | Nonce verification recommended | ||
| #4471 | Elementor Blocks for Gutenberg | 80 | 7 | 6 | 10k+ | Output is not escaped | ||
| #4472 | ShopEngine Gutenberg WooCommerce Builder Blocks Addon – All in One WooCommerce Solution | 80 | 424 | 735 | 3k+ | Non-prefixed global variable | ||
| #4473 | Cost Calculator for Elementor | 80 | 223 | 17 | 500 | wp function not compatible with requires wp | ||
| #4474 | Custom Icons for Elementor | 80 | 6 | 25 | 10k+ | Non-prefixed global variable | ||
| #4475 | Content Blocks (Custom Post Widget) | 80 | 6 | 2 | 10k+ | Output is not escaped | ||
| #4476 | Duo Universal | 80 | 6 | 25 | 2k+ | Nonce verification recommended | ||
| #4477 | Fluent PDF Generator | 80 | 102 | 6 | 20k+ | Text Domain Mismatch | ||
| #4478 | Fonts | 80 | 8 | 5 | 8k+ | Output is not escaped | ||
| #4479 | Ailo – AI Slug Translator | 80 | 8 | 14 | 1k+ | wp function not compatible with requires wp | ||
| #4480 | Media Library File Size | 80 | 3 | 15 | 6k+ | Nonce verification recommended | ||
| #4481 | Mu Manager – Manage mu-plugins like standard plugins | 80 | 21 | 18 | 800 | Missing Arg Domain | ||
| #4482 | Nudgify Social Proof | 80 | 3 | 12 | 500 | Discouraged PHP function | ||
| #4483 | Plugin Toggle | 80 | 2 | 12 | 500 | Nonce verification recommended | ||
| #4484 | Podamibe Custom User Gravatar | 80 | 12 | 8 | 3k+ | Non Singular String Literal Domain | ||
| #4485 | Post Carousel Addons For Elementor | 80 | 9 | 8 | 1k+ | Output is not escaped | ||
| #4486 | Smart Passworded Pages | 80 | 11 | 8 | 2k+ | wp function not compatible with requires wp | ||
| #4487 | SteadFast API | 80 | 2 | 23 | 8k+ | Non-prefixed global variable | ||
| #4488 | Gift Wrapper for WooCommerce | 80 | 111 | 125 | 2k+ | Text Domain Mismatch | ||
| #4489 | Advanced Image Hover Effect for Elementor | 81 | 251 | 8 | 1k+ | Text Domain Mismatch | ||
| #4490 | Blocksy Companion | 81 | 1,075 | 300k+ | Non-prefixed global variable | |||
| #4491 | Column Ordering For Elementor | 81 | 21 | 6 | 1k+ | Text Domain Mismatch | ||
| #4492 | cookie-cat | 81 | 14 | 27 | 1k+ | Non-prefixed function | ||
| #4493 | Joinchat – Enhanced "click to chat" | 81 | 17 | 32 | 700k+ | wp function not compatible with requires wp | ||
| #4494 | eCommerce Shipping Dashboard by UPS for WooCommerce | 81 | 6 | 35 | 1k+ | Non-prefixed constant | ||
| #4495 | Gutenverse Companion | 81 | 16 | 29 | 8k+ | Nonce verification recommended | ||
| #4496 | MM Title Manager — Hide Page and Post Title | 81 | 4 | 4 | 9k+ | Unsafe printing function | ||
| #4497 | HivePress Geolocation | 81 | 2 | 25 | 7k+ | Nonce verification recommended | ||
| #4498 | LottieFiles – JSON Based Animation Lottie & Bodymovin for Elementor | 81 | 162 | 9 | 3k+ | Text Domain Mismatch | ||
| #4499 | Info Cards – Add Text and Media in Card Layouts | 81 | 7 | 25 | 2k+ | Non-prefixed namespace | ||
| #4500 | LoftLoader | 81 | 17 | 19 | 70k+ | Missing direct file access protection |
