WordPress.Security.NonceVerification.Recommended
Nonce verification recommended
The code reads request data in a place where Plugin Check recommends a nonce check.
Why It Shows Up
The scan saw request handling that may not always mutate state, but still looks like a user-triggered action that should usually be protected by a nonce.
Why It Matters
Adding a nonce reduces accidental or forged requests and documents that the action is expected to originate from the plugin UI.
How to Fix
- For admin forms and action links, add and verify a nonce.
- For AJAX handlers, use `check_ajax_referer()`.
- For public read-only endpoints, document why a nonce is not required and keep input validation strict.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #4651 | Koala AI | 89 | 9 | 1k+ | Nonce verification recommended | |||
| #4652 | Loading Page with Loading Screen | 89 | 49 | 18 | 10k+ | wp function not compatible with requires wp | ||
| #4653 | m1.DownloadList | 89 | 2 | 6 | 400 | Nonce verification recommended | ||
| #4654 | Merchant Center Reviews for WooCommerce | 89 | 2 | 11 | 500 | Missing Version | ||
| #4655 | PayJustNow for WooCommerce | 89 | 1 | 18 | 900 | Nonce verification recommended | ||
| #4656 | Popups for Divi | 89 | 99 | 57 | 100k+ | Text Domain Mismatch | ||
| #4657 | RateMyAgent Official | 89 | 1 | 158 | 400 | Non-prefixed namespace | ||
| #4658 | Raychat | 89 | 1 | 11 | 800 | Discouraged text-domain loading | ||
| #4659 | Real Custom Post Order: Create a custom order for your content | 89 | 1 | 19 | 8k+ | Non-prefixed global variable | ||
| #4660 | Shipping by City for Woocommerce | 89 | 13 | 2 | 400 | Text Domain Mismatch | ||
| #4661 | Statify | 89 | 5 | 33 | 100k+ | Direct Query | ||
| #4662 | Széchenyi 2020 Logo | 89 | 140 | 9 | 900 | Text Domain Mismatch | ||
| #4663 | User Role for Flamingo | 89 | 2 | 4 | 700 | Non-prefixed function | ||
| #4664 | Password Strength Settings for WooCommerce | 89 | 17 | 6 | 10k+ | Missing Arg Domain | ||
| #4665 | Disable User Login | 89 | 1 | 20 | 500 | Direct Query | ||
| #4666 | WPC Smart Notifications for WooCommerce | 89 | 79 | 600 | Non-prefixed global variable | |||
| #4667 | WPC Variation Swatches for WooCommerce | 89 | 29 | 7k+ | Non-prefixed global variable | |||
| #4668 | Cryptocurrency Widgets For Elementor | 90 | 1 | 33 | 1k+ | Non-prefixed global variable | ||
| #4669 | Duplicate PP | 90 | 8 | 10k+ | Non-prefixed constant | |||
| #4670 | Lawwwing | Textos legales web y Banner de cookies | 90 | 31 | 13 | 700 | Text Domain Mismatch | ||
| #4671 | User Profile Picture | 90 | 50 | 40k+ | Non-prefixed hook name | |||
| #4672 | Shipping Cost on Product Page Calculator for WooCommerce | 90 | 3 | 14 | 400 | Non-prefixed global variable | ||
| #4673 | Reading Position Indicator | 90 | 2 | 23 | 800 | Dynamic hook name | ||
| #4674 | SocialFeeds | 90 | 10 | 20k+ | Nonce verification recommended | |||
| #4675 | WPC Smart Compare for WooCommerce | 90 | 22 | 70k+ | Nonce verification recommended | |||
| #4676 | WPC Smart Quick View for WooCommerce | 90 | 25 | 90k+ | Nonce verification recommended | |||
| #4677 | WowShipping – Weight Based Table Rate Shipping with Live Rates for UPS, USPS, DHL | 90 | 26 | 19 | 500 | Text Domain Mismatch | ||
| #4678 | WP-Speech-Balloon | 90 | 5 | 10 | 400 | trademarked term | ||
| #4679 | Local Business Schema (JSON-LD) Lite | 90 | 155 | 8 | 3k+ | Text Domain Mismatch | ||
| #4680 | Contact Form 7 Syntax Highlighting | 91 | 4 | 10 | 1k+ | Nonce verification recommended | ||
| #4681 | Contact Form 7 – email body TinyMCE editor | 91 | 4 | 6 | 400 | Nonce verification recommended | ||
| #4682 | Clio Grow Form | 91 | 179 | 19 | 1k+ | Text Domain Mismatch | ||
| #4683 | Curator.io | 91 | 3 | 9 | 2k+ | Nonce verification recommended | ||
| #4684 | Disable WordPress Update Notifications and auto-update Email Notifications | 91 | 2 | 12 | 10k+ | Nonce verification recommended | ||
| #4685 | Fonto – Custom Web Fonts Manager | 91 | 22 | 2k+ | Dynamic hook name | |||
| #4686 | Edit Entries for Gravity Forms | 91 | 5 | 3 | 2k+ | Nonce verification recommended | ||
| #4687 | Meks Quick Plugin Disabler | 91 | 3 | 8 | 1k+ | Nonce verification recommended | ||
| #4688 | PDF Embedder | 91 | 1 | 7 | 300k+ | Non-prefixed class | ||
| #4689 | Prevent Browser Caching | 91 | 2 | 15 | 10k+ | Non-prefixed hook name | ||
| #4690 | PS User Login Count | 91 | 7 | 7 | 400 | Missing Arg Domain | ||
| #4691 | Simple Chat Button | 91 | 4 | 40k+ | Nonce verification recommended | |||
| #4692 | Smooth Page Scroll Up/Down Buttons | 91 | 1 | 5 | 2k+ | Non-prefixed function | ||
| #4693 | Tumblr Importer | 91 | 7 | 9 | 10k+ | wp function not compatible with requires wp | ||
| #4694 | Commerce7 for WordPress | 91 | 2 | 93 | 1k+ | Non-prefixed global variable | ||
| #4695 | WPC Custom Related Products for WooCommerce | 91 | 26 | 1k+ | Non-prefixed class | |||
| #4696 | XPS Ship Integration | 91 | 58 | 20 | 1k+ | Text Domain Mismatch | ||
| #4697 | Cookie Consent – GDPR & CCPA Cookie Banner & Consent Manager | 92 | 16 | 10k+ | Direct Query | |||
| #4698 | Cryptocurrency Widgets – Price Ticker & Coins List | 92 | 4 | 36 | 7k+ | Non-prefixed global variable | ||
| #4699 | Mongoose Page Plugin | 92 | 4 | 17 | 10k+ | Non-prefixed global variable | ||
| #4700 | Force Plugin Updates Check | 92 | 5 | 5 | 500 | trademarked term |
