| #151 | Ultra Addons for Contact Form 7 | 24 | 1,538 | 460 | 60k+ | | | Text Domain Mismatch |
| #152 | User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder | 24 | 664 | 3,318 | 60k+ | | | Non-prefixed global variable |
| #153 | WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors | 24 | 168 | 584 | 4k+ | | | Non-prefixed class |
| #154 | Payment Gateway for PayPal on WooCommerce | 24 | 153 | 561 | 10k+ | | | Nonce verification recommended |
| #155 | EU VAT Assistant for WooCommerce | 24 | 1,742 | 495 | 5k+ | | | Non Singular String Literal Domain |
| #156 | European VAT Compliance Assistant for WooCommerce | 24 | 515 | 317 | 3k+ | | | Output is not escaped |
| #157 | WP Admin Audit | 24 | 1,051 | 781 | 1k+ | | | error log print r |
| #158 | WP RSS Aggregator – RSS Import, Feed to Post, Autoblogging, AI Content | 24 | 1,775 | 393 | 40k+ | | | Text Domain Mismatch |
| #159 | SchedulePress – Auto Post & Publish, Auto Social Share, Schedule Posts with Editorial Calendar & Missed Schedule Post Publisher | 24 | 296 | 245 | 10k+ | | | Output is not escaped |
| #160 | WP Travel – Ultimate Travel Booking System, Tour Management Engine | 24 | 226 | 1,951 | 4k+ | | | Non-prefixed hook name |
| #161 | WP Travel Engine – Tour Booking Plugin – Tour Operator Software | 24 | 2,010 | 5,688 | 20k+ | | | Non-prefixed global variable |
| #162 | WP User Manager – User Profile Builder & Membership | 24 | 787 | 539 | 10k+ | | | Exception output is not escaped |
| #163 | WPSpeed – WordPress Speed, Cache & Performance Optimization (Core Web Vitals, PageSpeed 100) | 24 | 482 | 189 | 2k+ | | | Output is not escaped |
| #164 | WpStream – Live Streaming, Video on Demand, Pay Per View | 24 | 1,712 | 740 | 3k+ | | | Text Domain Mismatch |
| #165 | Breeze Cache | 25 | 217 | 790 | 400k+ | | | Non-prefixed global variable |
| #166 | Broken Link Checker | 25 | 727 | 600 | 500k+ | | | Output is not escaped |
| #167 | CheckoutWC Lite | 25 | 1,359 | 850 | 3k+ | | | Text Domain Mismatch |
| #168 | Colissimo shipping methods for WooCommerce | 25 | 1,755 | 557 | 10k+ | | | Text Domain Mismatch |
| #169 | DecaLog | 25 | 943 | 236 | 1k+ | | | Exception output is not escaped |
| #170 | Demo Importer Plus | 25 | 58 | 239 | 10k+ | | | Non-prefixed hook name |
| #171 | Events Made Easy | 25 | 507 | 6,299 | 1k+ | | | Non-prefixed function |
| #172 | Site Kit by Google – Analytics, Search Console, AdSense, Speed | 25 | 1,304 | 242 | 5m+ | | | Missing direct file access protection |
| #173 | Sitemap by BestWebSoft – WordPress XML Site Map Page Generator Plugin | 25 | 608 | 207 | 20k+ | | | Text Domain Mismatch |
| #174 | Hydra Booking — Appointment Scheduling & Booking Calendar | 25 | 238 | 707 | 2k+ | | | Non-prefixed global variable |
| #175 | Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more | 25 | 4,010 | 1,262 | 2k+ | | | Text Domain Mismatch |
| #176 | Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force Prevention | 25 | 618 | 605 | 1m+ | | | Unsafe printing function |
| #177 | Loginizer | 25 | 814 | 504 | 1m+ | | | Output is not escaped |
| #178 | Media Cloud Sync | 25 | 1,095 | 274 | 1k+ | | | Exception output is not escaped |
| #179 | MyFatoorah – WooCommerce | 25 | 191 | 89 | 3k+ | | | Output is not escaped |
| #180 | PDF & Print by BestWebSoft – WordPress Posts and Pages PDF Generator Plugin | 25 | 1,084 | 1,296 | 9k+ | | | Non-prefixed global variable |
| #181 | Poll Maker by AYS – Versus Polls, Anonymous Polls, Image Polls | 25 | 486 | 1,414 | 7k+ | | | Non-prefixed global variable |
| #182 | BerqWP – Automatic WordPress Website Speed Optimization | 25 | 198 | 501 | 3k+ | | | Non-prefixed global variable |
| #183 | Secure Copy Content Protection and Content Locking | 25 | 958 | 799 | 20k+ | | | Output is not escaped |
| #184 | ShopMagic – email automation | 25 | 228 | 145 | 10k+ | | | Exception output is not escaped |
| #185 | Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin | 25 | 960 | 738 | 60k+ | | | Text Domain Mismatch |
| #186 | Tamara Checkout | 25 | 601 | 228 | 2k+ | | | Exception output is not escaped |
| #187 | Social Media Share Buttons & Social Sharing Icons | 25 | 2,433 | 1,383 | 100k+ | | | Unsafe printing function |
| #188 | Social Share Icons & Social Share Buttons | 25 | 2,365 | 1,357 | 10k+ | | | Output is not escaped |
| #189 | VikBooking Hotel Booking Engine & PMS | 25 | 13,232 | 8,312 | 8k+ | | | Output is not escaped |
| #190 | WP Review Slider | 25 | 1,186 | 2,279 | 6k+ | | | Non-prefixed global variable |
| #191 | WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan | 25 | 727 | 1,554 | 50k+ | | | Non-prefixed global variable |
| #192 | SlimStat Analytics | 25 | 1,177 | 870 | 70k+ | | | Exception output is not escaped |
| #193 | WP Statistics – Simple, privacy-friendly Google Analytics alternative | 25 | 610 | 2,465 | 600k+ | | | Non-prefixed global variable |
| #194 | WPvivid Backup for MainWP | 25 | 818 | 1,794 | 10k+ | | | Missing nonce verification |
| #195 | WPvivid — Backup, Migration & Staging | 25 | 899 | 1,461 | 900k+ | | | Non-prefixed namespace |
| #196 | Accept Donations with PayPal & Stripe | 26 | 916 | 572 | 10k+ | | | Unsafe printing function |
| #197 | FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) | 26 | 591 | 416 | 2k+ | | | Exception output is not escaped |
| #198 | Omise Payments | 26 | 358 | 256 | 2k+ | | | Output is not escaped |
| #199 | Barion Payment Gateway for WooCommerce | 26 | 71 | 221 | 6k+ | | | Non-prefixed global variable |
| #200 | Pressidium Cookie Consent | 26 | 203 | 95 | 10k+ | | | Exception output is not escaped |