WordPress.Security.NonceVerification.Recommended
Nonce verification recommended
The code reads request data in a place where Plugin Check recommends a nonce check.
Why It Shows Up
The scan saw request handling that may not always mutate state, but still looks like a user-triggered action that should usually be protected by a nonce.
Why It Matters
Adding a nonce reduces accidental or forged requests and documents that the action is expected to originate from the plugin UI.
How to Fix
- For admin forms and action links, add and verify a nonce.
- For AJAX handlers, use `check_ajax_referer()`.
- For public read-only endpoints, document why a nonce is not required and keep input validation strict.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #4551 | Soro – SEO Autopilot & AI Content Writer | 83 | 4 | 10 | 10k+ | Input is not sanitized | ||
| #4552 | TCD Classic Editor | 83 | 1 | 11 | 5k+ | Nonce verification recommended | ||
| #4553 | Team Section Block – Showcase Team Members with Layout Options | 83 | 1 | 21 | 1k+ | Non-prefixed namespace | ||
| #4554 | Unlist Posts & Pages | 83 | 5 | 9 | 10k+ | Nonce verification recommended | ||
| #4555 | WPC AJAX Search for WooCommerce | 83 | 1 | 29 | 1k+ | Nonce verification recommended | ||
| #4556 | WPC Order Tip for WooCommerce | 83 | 55 | 1k+ | Non-prefixed global variable | |||
| #4557 | Image Gallery Block | 84 | 9 | 22 | 2k+ | Non-prefixed global variable | ||
| #4558 | Astra Theme Visual Hooks | 84 | 54 | 5 | 2k+ | Text Domain Mismatch | ||
| #4559 | Wbcom Designs – Birthday Widget for BuddyPress | 84 | 163 | 13 | 400 | Text Domain Mismatch | ||
| #4560 | Cachify | 84 | 9 | 36 | 9k+ | Non-prefixed global variable | ||
| #4561 | Disable Elements for WPBakery Page Builder | 84 | 2 | 9 | 500 | trademarked term | ||
| #4562 | Duplicate taxonomy terms and ACF fields | 84 | 3 | 8 | 500 | Input is not validated | ||
| #4563 | Editor Enhancer for Oxygen | 84 | 3 | 10 | 500 | Nonce verification recommended | ||
| #4564 | FlippingBook | 84 | 14 | 6 | 2k+ | Missing Translators Comment | ||
| #4565 | LearnPress – Prerequisites Courses | 84 | 8 | 14 | 6k+ | Non-prefixed constant | ||
| #4566 | MotoPress Hotel Booking for Elementor | 84 | 3 | 19 | 10k+ | Non-prefixed global variable | ||
| #4567 | Nav Menu Roles | 84 | 3 | 18 | 70k+ | Non-prefixed hook name | ||
| #4568 | Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers | 84 | 1 | 73 | 70k+ | Direct Query | ||
| #4569 | Safelayout Cute Preloader – CSS3 WordPress Preloader | 84 | 3 | 14 | 10k+ | Input is not validated | ||
| #4570 | Search by ID | 84 | 3 | 5 | 700 | Input is not sanitized | ||
| #4571 | SellKit – Funnel builder and checkout optimizer for WooCommerce to sell more, faster | 84 | 9 | 17 | 8k+ | Non-prefixed class | ||
| #4572 | Timeline Module for Divi | 84 | 16 | 11 | 3k+ | Text Domain Mismatch | ||
| #4573 | Ultra Addons Lite for Elementor | 84 | 30 | 18 | 700 | wp function not compatible with requires wp | ||
| #4574 | UTMs Carry Pages | 84 | 4 | 11 | 400 | Non-prefixed global variable | ||
| #4575 | Easy Duplicate Product for WooCommerce | 84 | 7 | 8 | 3k+ | Missing direct file access protection | ||
| #4576 | WP Link Preview | 84 | 4 | 9 | 500 | trademarked term | ||
| #4577 | Override String Translations | 84 | 8 | 6 | 1k+ | Nonce verification recommended | ||
| #4578 | WPC Grouped Product for WooCommerce | 84 | 45 | 3k+ | Nonce verification recommended | |||
| #4579 | WPLANG Lite | 84 | 8 | 5 | 400 | trademarked term | ||
| #4580 | Fetchify | 85 | 154 | 19 | 600 | Text Domain Mismatch | ||
| #4581 | Consent Mode Banner | 85 | 3 | 7 | 400 | Missing Version | ||
| #4582 | JAMP Notes (Just Another Memo Plugin) | 85 | 170 | 183 | 400 | Text Domain Mismatch | ||
| #4583 | Referrer Input for Contact Form 7 | 85 | 39 | 2 | 500 | wp function not compatible with requires wp | ||
| #4584 | Shiprocket | 85 | 56 | 15 | 10k+ | Text Domain Mismatch | ||
| #4585 | Export Orders for WooCommerce – CSV, Excel, XML, JSON & PDF Export | 85 | 24 | 9 | 400 | wp function not compatible with requires wp | ||
| #4586 | WPC Estimated Delivery Date for WooCommerce | 85 | 67 | 10k+ | Non-prefixed global variable | |||
| #4587 | WPC Variations Table for WooCommerce | 85 | 34 | 400 | Non-prefixed hook name | |||
| #4588 | Featured image to All-Posts | 86 | 6 | 5 | 400 | Nonce verification recommended | ||
| #4589 | Advanced Queries | 86 | 6 | 11 | 10k+ | Non-prefixed constant | ||
| #4590 | AM LottiePlayer | 86 | 5 | 12 | 800 | Non-prefixed global variable | ||
| #4591 | Block Pattern Builder | 86 | 10 | 5 | 600 | Missing Translators Comment | ||
| #4592 | Catch Breadcrumb | 86 | 1 | 29 | 2k+ | Non-prefixed global variable | ||
| #4593 | Custom Error Messages for Gravity Forms | 86 | 3 | 4 | 400 | Output is not escaped | ||
| #4594 | Debug Bar Actions and Filters Addon | 86 | 6 | 4 | 400 | Forbidden PHP function found | ||
| #4595 | Extra Styling for MemberPress | 86 | 64 | 7 | 500 | Text Domain Mismatch | ||
| #4596 | Hotfix | 86 | 11 | 8 | 4k+ | Deprecated class: services_json | ||
| #4597 | Shoppable Images (Lookbook) for WooCommerce | 86 | 21 | 31 | 6k+ | Missing direct file access protection | ||
| #4598 | Add post thumbnail to wp-admin list view | 86 | 5 | 5 | 400 | Nonce verification recommended | ||
| #4599 | NS Featured Posts | 86 | 2 | 15 | 4k+ | Nonce verification recommended | ||
| #4600 | Popup Trigger URL for Elementor Pro | 86 | 2 | 4 | 10k+ | Nonce verification recommended |
