WordPress.Security.NonceVerification.Recommended
Nonce verification recommended
The code reads request data in a place where Plugin Check recommends a nonce check.
Why It Shows Up
The scan saw request handling that may not always mutate state, but still looks like a user-triggered action that should usually be protected by a nonce.
Why It Matters
Adding a nonce reduces accidental or forged requests and documents that the action is expected to originate from the plugin UI.
How to Fix
- For admin forms and action links, add and verify a nonce.
- For AJAX handlers, use `check_ajax_referer()`.
- For public read-only endpoints, document why a nonce is not required and keep input validation strict.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #4601 | Sharespine Woocommerce Connector | 86 | 2 | 16 | 500 | error log error log | ||
| #4602 | Social Divi | 86 | 15 | 8 | 2k+ | Missing direct file access protection | ||
| #4603 | Ticket Tailor — Event Ticketing & Registration | 86 | 3 | 3 | 4k+ | Non Enqueued Script | ||
| #4604 | Unlimited Theme Addon For Elementor | 86 | 74 | 68 | 600 | Missing direct file access protection | ||
| #4605 | VenoMaps – OpenStreetMap & Privacy-Friendly Geo Maps | 86 | 20 | 6 | 400 | wp function not compatible with requires wp | ||
| #4606 | Delete product images for WooCommerce | 86 | 3 | 13 | 1k+ | Direct Query | ||
| #4607 | WC MyParcel Belgium | 86 | 340 | 79 | 600 | Text Domain Mismatch | ||
| #4608 | Wompi Portal de Pagos | 86 | 23 | 10 | 5k+ | wp function not compatible with requires wp | ||
| #4609 | WooCommerce Payfast Gateway | 86 | 90 | 47 | 30k+ | Text Domain Mismatch | ||
| #4610 | Advanced Image Comparison for Elementor | 87 | 1 | 5 | 1k+ | Nonce verification recommended | ||
| #4611 | Author Filters | 87 | 2 | 7 | 1k+ | Nonce verification recommended | ||
| #4612 | Authors List | 87 | 2 | 16 | 5k+ | Nonce verification recommended | ||
| #4613 | LocoAI – Auto Translate for Loco Translate | 87 | 10 | 41 | 70k+ | Non-prefixed global variable | ||
| #4614 | Catch Infinite Scroll | 87 | 20 | 10k+ | Non-prefixed global variable | |||
| #4615 | Disable User Password Reset Admin Notifications | 87 | 6 | 2 | 1k+ | Nonce verification recommended | ||
| #4616 | Farsi Font for Elementor | 87 | 11 | 2 | 1k+ | Missing Translators Comment | ||
| #4617 | I Recommend This – Love/Like Button for WordPress Posts | 87 | 3 | 49 | 5k+ | Direct Query | ||
| #4618 | Image Optimization – Compress Images and Convert to WebP or AVIF | 87 | 15 | 24 | 1m+ | Missing Translators Comment | ||
| #4619 | Image Ticker Carousel | by Creavi | 87 | 2 | 17 | 400 | Nonce verification recommended | ||
| #4620 | Minimum Purchase Amount For Woo Cart – For WooCommerce | 87 | 72 | 8 | 5k+ | Text Domain Mismatch | ||
| #4621 | No Category Base (WPML) | 87 | 5 | 5 | 100k+ | Missing direct file access protection | ||
| #4622 | Object Cache 4 everyone | 87 | 2 | 65 | 5k+ | Non-prefixed function | ||
| #4623 | Parallax Section Block – Add Parallax Scrolling Effects to Sections. | 87 | 3 | 22 | 3k+ | Non-prefixed global variable | ||
| #4624 | Security Header Generator | 87 | 10 | 20 | 500 | Non Singular String Literal Text | ||
| #4625 | Export Single Post Page | 87 | 3 | 6 | 2k+ | Nonce verification recommended | ||
| #4626 | Smaily Connect | 87 | 52 | 2k+ | Non-prefixed global variable | |||
| #4627 | Snitch | 87 | 5 | 19 | 900 | Nonce verification recommended | ||
| #4628 | Tickera – Sell Tickets & Manage Events | 87 | 7 | 54 | 2k+ | Non-prefixed hook name | ||
| #4629 | Unnotifier — disable admin notices individually | 87 | 5 | 11 | 700 | Missing Translators Comment | ||
| #4630 | Variations as Single Product – Display Single Variation for WooCommerce | 87 | 8 | 33 | 1k+ | Direct Query | ||
| #4631 | Coupon Box for WooCommerce | 87 | 11 | 85 | 1k+ | Non-prefixed global variable | ||
| #4632 | Worldline Online Checkout | 88 | 4 | 16 | 1k+ | Nonce verification recommended | ||
| #4633 | Catch IDs | 88 | 16 | 20k+ | Non-prefixed global variable | |||
| #4634 | CPO Content Types | 88 | 13 | 25 | 3k+ | Missing direct file access protection | ||
| #4635 | Security Headers | 88 | 2 | 6 | 700 | Nonce verification recommended | ||
| #4636 | MC4WP: Mailchimp Top Bar – Email Subscribe Notification Bar | 88 | 1 | 21 | 7k+ | Non-prefixed global variable | ||
| #4637 | User IP and Location | 88 | 2 | 10 | 3k+ | Input is not sanitized | ||
| #4638 | Weather Effect | 88 | 381 | 4k+ | Non-prefixed global variable | |||
| #4639 | FlexMeeting – Webinar & Meeting Plugin for Jitsi Meet | 88 | 6 | 18 | 1k+ | Nonce verification recommended | ||
| #4640 | Divi Carousel Free (Divi5 Support) | 88 | 268 | 26 | 30k+ | Text Domain Mismatch | ||
| #4641 | WPC Admin Columns | 88 | 30 | 1k+ | Direct Query | |||
| #4642 | WPC Smart Linked Products – Upsells & Cross-sells for WooCommerce | 88 | 29 | 700 | Nonce verification recommended | |||
| #4643 | Address Validation and Autocomplete for WooCommerce | Addressfinder | 89 | 85 | 15 | 900 | Text Domain Mismatch | ||
| #4644 | Amedea – Unique Design Elements for Elementor | 89 | 1 | 25 | 500 | Mixed line endings | ||
| #4645 | Better Variation Price for WooCommerce | 89 | 5 | 12 | 1k+ | Nonce verification recommended | ||
| #4646 | Blog Filter – Post Grid Filter by Category or Tag | 89 | 1 | 5 | 7k+ | Nonce verification recommended | ||
| #4647 | Canvas | 89 | 19 | 112 | 10k+ | Non-prefixed global variable | ||
| #4648 | Classic Widgets with Block-based Widgets | 89 | 1 | 4 | 1k+ | Input is not sanitized | ||
| #4649 | Custom Layouts – Post + Product grids made easy | 89 | 23 | 22 | 4k+ | Missing Translators Comment | ||
| #4650 | Leadfeeder | 89 | 2 | 3 | 3k+ | Non-prefixed class |
