PluginScore

WordPress.Security.ValidatedSanitizedInput.InputNotValidatedNotSanitized

Input is not validated or sanitized

Request data is used without both cleanup and an allowability check.

critical weight

Why It Shows Up

The scan found a request value moving into code without sanitization and without validation.

Why It Matters

This combines two common input-handling failures: the value may contain unsafe content, and the code has not proven that the value is acceptable for the operation.

How to Fix

  • Call `wp_unslash()` on request input first.
  • Sanitize for the expected type or format.
  • Validate against allowed values, ranges, capabilities, and nonces before using the value.

References

WordPress validating, sanitizing, and escapingWordPress nonces

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#1Podlove Podcast Publisher182,3541,4333k+Output is not escaped
#2Realtyna Organic IDX plugin + WPL Real Estate189303,6362k+Non-prefixed global variable
#3WPPizza – A Restaurant Plugin184,6892,7031k+Text Domain Mismatch
#4Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)195363793m+Missing Translators Comment
#5WP Directory Kit191,5042,6382k+Non-prefixed global variable
#6Download Monitor204231,36480k+Non-prefixed hook name
#7Brevo – Email, SMS, Web Push, Chat, and more.20460646100k+Request data is not unslashed
#8WP Minify Fix20306380800Output is not escaped
#9Kadence Security – Password, Two Factor Authentication, and Brute Force Protection211,060957700k+Missing Translators Comment
#10Captcha Them All213003235k+Output is not escaped
#11Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More212,5721,2771m+Output is not escaped
#12Feeds for YouTube (YouTube video, channel, and gallery plugin)21558978100k+Output is not escaped
#13Leyka212573,4462k+Request data is not unslashed
#14Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages211,1202,9139k+Non-prefixed global variable
#15WP Compress – Instant Performance & Speed Optimization213,3673,25310k+Non Singular String Literal Domain
#16WP Sessions Time Monitoring Full Automatic228691,529500Non-prefixed global variable
#17Better WordPress Minify224124847k+Non Singular String Literal Domain
#18Code Profiler – WordPress Performance Profiling and Debugging Made Easy222654008k+Non-prefixed global variable
#19Database Access with Adminer229832,5531k+Non-prefixed global variable
#20Download Manager222,5131,459100k+Output is not escaped
#21Events Manager – Calendar, Bookings, Tickets, and more!224,7165,69070k+Output is not escaped
#22Falang multilanguage for WordPress227167691k+Output is not escaped
#23History Log by click5226751,290400Direct Query
#24If-So Dynamic Content – Elementor & All Page Builders Personalization229668397k+Output is not escaped
#25Mail Baby SMTP22385699600SQL query is not prepared
#26MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder221,1203,0122k+Non-prefixed global variable
#27MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution221,1311,846800Non-prefixed global variable
#28Motors – Car Dealership & Classified Listings Plugin225,3435,9559k+Text Domain Mismatch
#29NinjaFirewall (WP Edition) – Advanced Security Plugin and Firewall221,2632,046100k+Non-prefixed global variable
#30NinjaScanner – Virus & Malware scan2259655130k+Non-prefixed global variable
#31Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App221,5812,326300k+Non-prefixed global variable
#32Quick Contact Form222606231k+Non-prefixed function
#33Sellsy22586490400Non Singular String Literal Domain
#34Slim Jetpack222,5861,9472k+Text Domain Mismatch
#35WCFM Membership – WooCommerce Memberships for Multivendor Marketplace2255967510k+Non-prefixed global variable
#36Wenprise WeChatPay Payment Gateway For WooCommerce22443178400Exception output is not escaped
#37WP Super Minify • Minify, Compress and Cache HTML, CSS & JavaScript221642578k+Non-prefixed constant
#38WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell226,0042,7645k+Text Domain Mismatch
#39Admin and Site Enhancements (ASE)23139328200k+Nonce verification recommended
#40Smart Grid-Layout Design for Contact Form 72395445910k+Output is not escaped
#41Easy Digital Downloads – eCommerce Payments and Subscriptions made easy233,71910,28040k+Non-prefixed namespace
#42The GDPR Framework By Data443231,27749810k+Short PHP open tag found
#43MasterStudy LMS WordPress Plugin – for Online Courses and Education231,4384,89410k+Non-prefixed global variable
#44PowerPress Podcasting plugin by Blubrry234,8182,45220k+Output is not escaped
#45Manago AI & Leadoo AI236444291k+Unsafe printing function
#46Schema231,17324540k+Text Domain Mismatch
#47Shipment Tracker for Woocommerce234775762k+Missing Arg Domain
#48Simple URLs – Link Cloaking, Product Displays, and Affiliate Link Management232953014k+Non-prefixed global variable
#49A2 Optimized WP – Turbocharge and secure your WordPress site2427123160k+Missing Arg Domain
#50Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale)241,8651,0891k+Text Domain Mismatch