WordPress.Security.ValidatedSanitizedInput.InputNotValidated

Input is not validated

Request data is used without checking that it is allowed for the operation.

critical weight

Why It Shows Up

The scan found input from a request superglobal being used without validation such as capability checks, allowlists, type checks, or range checks.

Why It Matters

Sanitization cleans a value, but validation proves the value is acceptable. Missing validation can allow unexpected actions, invalid states, or unsafe query choices.

How to Fix

  • Check that IDs are positive integers, enum-like values are in an allowlist, and URLs or file paths are constrained.
  • Pair state-changing requests with nonce and capability checks.
  • Reject or safely default values that do not pass validation.

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#201WP Fusion Lite – Marketing Automation and CRM Integration for WordPress222766835k+Nonce verification recommended
#202WP Umbrella: Update Backup Restore & Monitoring2291590570k+Exception output is not escaped
#203Wp-Insert2226730110k+Output is not escaped
#204WP Super Minify • Minify, Compress and Cache HTML, CSS & JavaScript221642579k+Non-prefixed constant
#205User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration222871,43220k+Non-prefixed global variable
#206WPBITS Addons For Elementor Page Builder229961,3992k+Non-prefixed global variable
#207WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell225,9962,7906k+Text Domain Mismatch
#208School Management System – WPSchoolPress223145,2201k+Non-prefixed global variable
#209WPSSO Core – Complete Schema Markup and Meta Tags221,4074125k+Missing Translators Comment
#210ЮKassa для WooCommerce225911689k+Short PHP open tag found
#211Recipe Cards For Your Food Blog from Zip Recipes221,1261,7311k+Non-prefixed global variable
#212Advanced Custom Fields: Extended231,885329100k+Text Domain Mismatch
#213Custom WooCommerce Checkout Fields Editor237551,3862k+Non-prefixed global variable
#214Admin and Site Enhancements (ASE)23136330200k+Nonce verification recommended
#215Advanced Product Labels for WooCommerce2392155920k+Text Domain Mismatch
#216Affiliate Super Assistent231,2802672k+Text Domain Mismatch
#217Autoptimize23288191800k+Output is not escaped
#218B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More231,34740910k+Text Domain Mismatch
#219BA Book Everything231,1841,08610k+Output is not escaped
#220Beds24 Online Booking235323742k+wp function not compatible with requires wp
#221Kadence Security – Password, Two Factor Authentication, and Brute Force Protection231,053967700k+Missing Translators Comment
#222BlossomThemes Email Newsletter2333723920k+Output is not escaped
#223Booking calendar, Appointment Booking System231,0791,1254k+Output is not escaped
#224Brave Popup Builder – Popup, Optins, Lead Generation, Survey & Interactive Content2323829420k+error log print r
#225BSK PDF Manager231,5766257k+Text Domain Mismatch
#226BuddyDrive237221,5971k+Non-prefixed global variable
#227Announcement & Notification Banner – Bulletin239301,5762k+Non-prefixed global variable
#228Burger Companion233,27447210k+Text Domain Mismatch
#229Business Directory Plugin – Easy Listing Directories for WordPress236111,05810k+Non-prefixed global variable
#230Captivate Sync231745571k+Non-prefixed global variable
#231Cart Notices for WooCommerce236504712k+Text Domain Mismatch
#232WPBot – AI ChatBot for Live Support, Lead Generation, AI Services232641,0385k+Non-prefixed global variable
#233Classified Listing – AI-Powered Classified ads & Business Directory231551,8619k+Non-prefixed global variable
#234CleanTalk Anti-Spam. Spam Firewall & Bot protection238261,078200k+Missing nonce verification
#235Content Aware Sidebars – Fastest Widget Area Plugin239931,73830k+Non-prefixed global variable
#236Content Egg – Affiliate Product Importer & Price Comparison231,2311,25710k+Non-prefixed global variable
#237Content Views – Post Grid & Filter, Recent Posts, Category Posts … (Shortcode, Gutenberg Blocks, and Widgets for Elementor)23306587100k+Dynamic hook name
#238CWW Companion233072231k+Output is not escaped
#239Disable Bloat for WordPress & WooCommerce238631,32510k+Non-prefixed global variable
#240DK PDF – WordPress PDF Generator237443353k+Exception output is not escaped
#241Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy2317082140k+Non-prefixed global variable
#242Easy Age Verify231,1382,6311k+Non-prefixed global variable
#243Easy Digital Downloads – eCommerce Payments and Subscriptions made easy233,72310,28340k+Non-prefixed namespace
#244Ecwid by Lightspeed Ecommerce Shopping Cart2333930720k+Missing direct file access protection
#245Error Log Monitor236941,41420k+Non-prefixed global variable
#246Essential Real Estate235295,0608k+Non-prefixed global variable
#247EventON – Events Calendar232,5851,0216k+Text Domain Mismatch
#248Events Addon for Elementor237791,3397k+Non-prefixed global variable
#249Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI233951,34290k+Non-prefixed global variable
#250Ezoic2343251610k+Output is not escaped