PluginScore

WordPress.Security.ValidatedSanitizedInput.InputNotValidatedNotSanitized

Input is not validated or sanitized

Request data is used without both cleanup and an allowability check.

critical weight

Why It Shows Up

The scan found a request value moving into code without sanitization and without validation.

Why It Matters

This combines two common input-handling failures: the value may contain unsafe content, and the code has not proven that the value is acceptable for the operation.

How to Fix

  • Call `wp_unslash()` on request input first.
  • Sanitize for the expected type or format.
  • Validate against allowed values, ranges, capabilities, and nonces before using the value.

References

WordPress validating, sanitizing, and escapingWordPress nonces

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#1WPPizza – A Restaurant Plugin184,6892,7031k+Text Domain Mismatch
#2Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)195303753m+Missing Translators Comment
#3WP Directory Kit191,5022,6412k+Non-prefixed global variable
#4Download Monitor204231,36780k+Non-prefixed hook name
#5Brevo – Email, SMS, Web Push, Chat, and more.20460646100k+Request data is not unslashed
#6WP Compress – Instant Performance & Speed Optimization204,2913,69010k+Non Singular String Literal Domain
#7WP Minify Fix20306380800Output is not escaped
#8Kadence Security – Password, Two Factor Authentication, and Brute Force Protection211,060957700k+Missing Translators Comment
#9Captcha Them All213003235k+Output is not escaped
#10Feeds for YouTube (YouTube video, channel, and gallery plugin)21503995100k+Output is not escaped
#11Leyka212573,4462k+Request data is not unslashed
#12Motors – Car Dealership & Classified Listings Plugin215,4036,1199k+Text Domain Mismatch
#13Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages211,1202,9138k+Non-prefixed global variable
#14WP Sessions Time Monitoring Full Automatic228691,529500Non-prefixed global variable
#15Better WordPress Minify224124847k+Non Singular String Literal Domain
#16Code Profiler – WordPress Performance Profiling and Debugging Made Easy222654008k+Non-prefixed global variable
#17Database Access with Adminer229832,5531k+Non-prefixed global variable
#18Download Manager222,4441,489100k+Output is not escaped
#19Events Manager – Calendar, Bookings, Tickets, and more!224,7125,69060k+Output is not escaped
#20Falang multilanguage for WordPress227167701k+Output is not escaped
#21History Log by click5226751,290400Direct Query
#22If-So Dynamic Content – Elementor & All Page Builders Personalization229698447k+Output is not escaped
#23Mail Baby SMTP22385699500SQL query is not prepared
#24MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder221,1203,0122k+Non-prefixed global variable
#25MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution221,1321,844700Non-prefixed global variable
#26MasterStudy LMS WordPress Plugin – for Online Courses and Education221,4504,93810k+Non-prefixed global variable
#27NinjaFirewall (WP Edition) – Advanced Security Plugin and Firewall221,2632,046100k+Non-prefixed global variable
#28NinjaScanner – Virus & Malware scan2259655130k+Non-prefixed global variable
#29Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App221,6022,342300k+Non-prefixed global variable
#30Quick Contact Form222606231k+Non-prefixed function
#31Manago AI & Leadoo AI226364601k+Unsafe printing function
#32Sellsy22586490400Non Singular String Literal Domain
#33Slim Jetpack222,5861,9472k+Text Domain Mismatch
#34Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin229362,941200k+Non-prefixed global variable
#35WCFM Membership – WooCommerce Memberships for Multivendor Marketplace2255164210k+Non-prefixed global variable
#36Wenprise WeChatPay Payment Gateway For WooCommerce22443178400Exception output is not escaped
#37WP Super Minify • Minify, Compress and Cache HTML, CSS & JavaScript221642579k+Non-prefixed constant
#38Admin and Site Enhancements (ASE)23145392200k+Nonce verification recommended
#39Smart Grid-Layout Design for Contact Form 72395445910k+Output is not escaped
#40Easy Digital Downloads – eCommerce Payments and Subscriptions made easy233,7028,48640k+Non-prefixed namespace
#41The GDPR Framework By Data443231,27849810k+Short PHP open tag found
#42Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN233,42887770k+Text Domain Mismatch
#43PowerPress Podcasting plugin by Blubrry234,7932,46120k+Output is not escaped
#44Realtyna Organic IDX plugin + WPL Real Estate235163,6202k+Non-prefixed global variable
#45Schema231,17324530k+Text Domain Mismatch
#46Shipment Tracker for Woocommerce234775761k+Missing Arg Domain
#47WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell236,2722,7795k+Text Domain Mismatch
#48A2 Optimized WP – Turbocharge and secure your WordPress site2427123160k+Missing Arg Domain
#49Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale)241,8651,0891k+Text Domain Mismatch
#50Blog Designer Pack – Blog, Post Grid, Post Slider, Post Carousel, Category Post, News246991,69430k+Non-prefixed global variable