WordPress.Security.NonceVerification.Recommended
Nonce verification recommended
The code reads request data in a place where Plugin Check recommends a nonce check.
Why It Shows Up
The scan saw request handling that may not always mutate state, but still looks like a user-triggered action that should usually be protected by a nonce.
Why It Matters
Adding a nonce reduces accidental or forged requests and documents that the action is expected to originate from the plugin UI.
How to Fix
- For admin forms and action links, add and verify a nonce.
- For AJAX handlers, use `check_ajax_referer()`.
- For public read-only endpoints, document why a nonce is not required and keep input validation strict.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #4501 | LoftLoader | 81 | 17 | 19 | 70k+ | Missing direct file access protection | ||
| #4502 | Nice Search | 81 | 4 | 5 | 900 | Input is not sanitized | ||
| #4503 | Payfast Gateway for WooCommerce | 81 | 2 | 18 | 2k+ | Missing nonce verification | ||
| #4504 | Physical Custom Upload Folder for Real Media Library | 81 | 4 | 9 | 900 | Nonce verification recommended | ||
| #4505 | Redirect by Custom Field | 81 | 5 | 6 | 600 | Nonce verification recommended | ||
| #4506 | Select and Multi-Select Field for Contact Form 7 | 81 | 25 | 12 | 2k+ | Text Domain Mismatch | ||
| #4507 | Orphans | 81 | 1 | 43 | 50k+ | Dynamic hook name | ||
| #4508 | Siteimprove | 81 | 6 | 23 | 800 | Nonce verification recommended | ||
| #4509 | SmartVideo – Video Player and CDN | 81 | 364 | 47 | 1k+ | Text Domain Mismatch | ||
| #4510 | Loops & Logic | 81 | 11 | 3 | 2k+ | Missing direct file access protection | ||
| #4511 | Telephone field for Gravity Forms | 81 | 124 | 9 | 400 | wp function not compatible with requires wp | ||
| #4512 | VS Event List | 81 | 1 | 259 | 8k+ | Non-prefixed global variable | ||
| #4513 | Force Authentification Before Checkout for WooCommerce | 81 | 12 | 4 | 6k+ | Output is not escaped | ||
| #4514 | Product SKU Generator for WooCommerce | 81 | 2 | 8 | 8k+ | Nonce verification recommended | ||
| #4515 | WP Events Manager WooCommerce | 81 | 20 | 10 | 1k+ | Text Domain Mismatch | ||
| #4516 | WP Subtitle | 81 | 7 | 33 | 10k+ | Non-prefixed hook name | ||
| #4517 | Wp Tracking Codes | 81 | 7 | 12 | 900 | Nonce verification recommended | ||
| #4518 | Add-on Brevo for Gravity Forms | 82 | 15 | 13 | 1k+ | Text Domain Mismatch | ||
| #4519 | Admin Collapse Subpages | 82 | 4 | 12 | 4k+ | Nonce verification recommended | ||
| #4520 | Catch Gallery | 82 | 1 | 35 | 10k+ | Non-prefixed hook name | ||
| #4521 | CodePen Embed Block | 82 | 8 | 3 | 600 | Text Domain Mismatch | ||
| #4522 | Editor Blocks for Gutenberg | 82 | 6 | 8 | 700 | Missing direct file access protection | ||
| #4523 | Iknow Extra | 82 | 6 | 5 | 400 | Missing direct file access protection | ||
| #4524 | Independent Analytics for MainWP | 82 | 7 | 13 | 700 | Nonce verification recommended | ||
| #4525 | Japanese Proofreading Preview | 82 | 11 | 5 | 400 | Nonce verification recommended | ||
| #4526 | Lazy Load for Videos | 82 | 6 | 37 | 9k+ | Non-prefixed constant | ||
| #4527 | Meks Easy Maps | 82 | 13 | 13 | 900 | Input is not sanitized | ||
| #4528 | PixTypes | 82 | 178 | 9k+ | Non-prefixed global variable | |||
| #4529 | Posts and Users Stats | 82 | 183 | 600 | Non-prefixed global variable | |||
| #4530 | Sticky Content – Make Any Section Sticky on Scroll | 82 | 24 | 9 | 400 | Text Domain Mismatch | ||
| #4531 | Tabs in Post Editor | 82 | 4 | 7 | 500 | Input is not validated | ||
| #4532 | WebP Conversion | 82 | 1 | 33 | 3k+ | Non-prefixed global variable | ||
| #4533 | Wicked Block Conditions | 82 | 6 | 6 | 600 | Nonce verification recommended | ||
| #4534 | Xpro Theme Builder For Elementor – FREE | 82 | 14 | 28 | 10k+ | Missing direct file access protection | ||
| #4535 | ACF Repeater & Flexible Content Collapser | 83 | 21 | 4 | 3k+ | Text Domain Mismatch | ||
| #4536 | Add To Cart Button Customizations | 83 | 66 | 14 | 400 | Text Domain Mismatch | ||
| #4537 | Change WordPress Login Logo | 83 | 5 | 9 | 20k+ | Non-prefixed function | ||
| #4538 | dLocal Go Payments | 83 | 9 | 15 | 400 | Missing Translators Comment | ||
| #4539 | Event Organiser Posterboard | 83 | 3 | 11 | 1k+ | Nonce verification recommended | ||
| #4540 | FormFacade – Embed Google Forms in your website | 83 | 8 | 17 | 1k+ | Nonce verification recommended | ||
| #4541 | GET Params | 83 | 3 | 8 | 1k+ | Nonce verification recommended | ||
| #4542 | HREFLANG Tags Management By Webnow | 83 | 2 | 34 | 600 | Non-prefixed global variable | ||
| #4543 | Inspectlet – AI-Powered Session Replay, Heatmaps & Analytics | 83 | 13 | 2 | 700 | Text Domain Mismatch | ||
| #4544 | All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login | 83 | 182 | 22 | 600 | wp function not compatible with requires wp | ||
| #4545 | Media Player Addons for Elementor – Audio and Video Widgets for Elementor | 83 | 1 | 8 | 1k+ | Nonce verification recommended | ||
| #4546 | Add menu separators to navigation | 83 | 8 | 7 | 900 | Non-prefixed hook name | ||
| #4547 | NETSENSAI Shield | 83 | 10 | 16 | 1k+ | Nonce verification recommended | ||
| #4548 | oik-privacy-policy | 83 | 14 | 42 | 700 | No Html Wrapped Strings | ||
| #4549 | Preserve Editor Scroll Position | 83 | 2 | 6 | 4k+ | Missing nonce verification | ||
| #4550 | Fixed Widget and Sticky Elements for WordPress | 83 | 7 | 13 | 80k+ | Non-prefixed global variable |
