WordPress.Security.NonceVerification.Recommended
Nonce verification recommended
The code reads request data in a place where Plugin Check recommends a nonce check.
Why It Shows Up
The scan saw request handling that may not always mutate state, but still looks like a user-triggered action that should usually be protected by a nonce.
Why It Matters
Adding a nonce reduces accidental or forged requests and documents that the action is expected to originate from the plugin UI.
How to Fix
- For admin forms and action links, add and verify a nonce.
- For AJAX handlers, use `check_ajax_referer()`.
- For public read-only endpoints, document why a nonce is not required and keep input validation strict.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #4701 | Cryptocurrency Widgets – Price Ticker & Coins List | 92 | 4 | 36 | 7k+ | Non-prefixed global variable | ||
| #4702 | Mongoose Page Plugin | 92 | 4 | 17 | 10k+ | Non-prefixed global variable | ||
| #4703 | Force Plugin Updates Check | 92 | 5 | 5 | 500 | trademarked term | ||
| #4704 | Product Gallery Slider, Additional Variation Images, Product Video, Product Image Zoom and Lightbox for WooCommerce – WooGallery | 92 | 6 | 30 | 20k+ | Non-prefixed global variable | ||
| #4705 | Paste As Plain Text By Default | 92 | 2 | 5 | 2k+ | Nonce verification recommended | ||
| #4706 | Range Slider Addon for Gravity Forms | 92 | 3 | 1k+ | Missing nonce verification | |||
| #4707 | Rox Appointment Booking – Appointment Booking Scheduling Solution | 92 | 3 | 7 | 1k+ | Nonce verification recommended | ||
| #4708 | RTL Tester | 92 | 6 | 2 | 1k+ | Nonce verification recommended | ||
| #4709 | Stencil | 92 | 6 | 8 | 1k+ | Non-prefixed function | ||
| #4710 | Image Hotspot With Tooltip For WPBakery Page Builder (formerly Visual Composer) | 92 | 61 | 12 | 400 | Text Domain Mismatch | ||
| #4711 | SFN Easy FAQ Manager | 92 | 127 | 14 | 2k+ | Text Domain Mismatch | ||
| #4712 | WP Anything Downloader | 92 | 1 | 7 | 3k+ | Nonce verification recommended | ||
| #4713 | WPC AJAX Add to Cart for WooCommerce | 92 | 28 | 10k+ | Non-prefixed hook name | |||
| #4714 | WPC Price by Quantity for WooCommerce | 92 | 37 | 1k+ | Non-prefixed global variable | |||
| #4715 | Advanced Testimonial Carousel For Elementor | 93 | 3 | 6 | 2k+ | Nonce verification recommended | ||
| #4716 | Animated Floating Chat Button | 93 | 5 | 3k+ | Nonce verification recommended | |||
| #4717 | CFS Options Screens | 93 | 10 | 5 | 400 | Text Domain Mismatch | ||
| #4718 | Disable CSS JS Cache | 93 | 9 | 400 | Non-prefixed function | |||
| #4719 | Disable Auto Update Emails and Block Updates for Plugins, WP Core, and Themes | 93 | 10 | 7 | 3k+ | Missing direct file access protection | ||
| #4720 | Social Sharing (by Danny) | 93 | 9 | 8 | 2k+ | Missing direct file access protection | ||
| #4721 | Shipping Live Rates for DHL Express for WooCommerce | 93 | 4 | 11 | 600 | Non-prefixed global variable | ||
| #4722 | Hide Updates | 93 | 3 | 4 | 6k+ | Nonce verification recommended | ||
| #4723 | Huurkalender WP | 93 | 3 | 7 | 800 | trademarked term | ||
| #4724 | Leira Letter Avatar | 93 | 3 | 8 | 6k+ | Non-prefixed hook name | ||
| #4725 | Modal Popup Box — Popup Maker & Popup Builder | 93 | 1 | 4 | 2k+ | Input is not sanitized | ||
| #4726 | Themx Maximum Upload File Size | Increase Maximum Upload File Size | 93 | 17 | 14 | 1k+ | Text Domain Mismatch | ||
| #4727 | Add to Cart Redirect for WooCommerce | 93 | 4 | 5 | 400 | Nonce verification recommended | ||
| #4728 | WPC Free Shipping Bar for WooCommerce | 93 | 18 | 3k+ | Non-prefixed class | |||
| #4729 | WPC Variation Duplicator for WooCommerce | 93 | 18 | 400 | Non-prefixed class | |||
| #4730 | WPC Variations Radio Buttons for WooCommerce | 93 | 18 | 6k+ | Non-prefixed class | |||
| #4731 | AI Image Alt Text Generator | 94 | 7 | 600 | Nonce verification recommended | |||
| #4732 | API KEY for Google Maps | 94 | 14 | 5 | 40k+ | Text Domain Mismatch | ||
| #4733 | Bricks Navigator | 94 | 1 | 5 | 8k+ | Nonce verification recommended | ||
| #4734 | Disk Usage Insights | 94 | 3 | 20 | 1k+ | Non-prefixed global variable | ||
| #4735 | Hash Link Scroll Offset | 94 | 9 | 4 | 1k+ | Text Domain Mismatch | ||
| #4736 | MobileMonkey X-Ray Installer | 94 | 4 | 3 | 400 | Missing direct file access protection | ||
| #4737 | Noindex Pages | 94 | 3 | 3 | 2k+ | Missing Version | ||
| #4738 | Outdated Plugin Notifier | 94 | 1 | 6 | 400 | trademarked term | ||
| #4739 | Password Passthrough | 94 | 2 | 3 | 500 | Nonce verification recommended | ||
| #4740 | Gulf currencies Symbols for WooCommerce – رمز الريال السعودي والدرهم الإماراتي | 94 | 6 | 900 | Nonce verification recommended | |||
| #4741 | Visual User Description Editor | 94 | 4 | 3 | 1k+ | wp function not compatible with requires wp | ||
| #4742 | Sticky Notes for WP Dashboard | 94 | 13 | 4 | 1k+ | wp function not compatible with requires wp | ||
| #4743 | Custom Branding for WooCommerce | 94 | 1 | 6 | 600 | Non-prefixed hook name | ||
| #4744 | WPC Product Quantity for WooCommerce | 94 | 32 | 2k+ | Non-prefixed global variable | |||
| #4745 | Airwallex Online Payments Gateway | 95 | 2 | 2 | 4k+ | Nonce verification recommended | ||
| #4746 | Blocks to Shortcode – Use blocks everywhere: in page templates, Elementor, etc. | 95 | 8 | 500 | Non-prefixed global variable | |||
| #4747 | Cool Timeline (Horizontal & Vertical Timeline) | 95 | 13 | 20k+ | Non-prefixed class | |||
| #4748 | Free PDF to Flipbook | 95 | 1 | 2 | 400 | Nonce verification recommended | ||
| #4749 | Post Lockdown | 95 | 5 | 3 | 1k+ | Missing direct file access protection | ||
| #4750 | Simple Spoiler | 95 | 1 | 8 | 2k+ | Non-prefixed global variable |
