| #101 | WP Compress – Instant Performance & Speed Optimization | 23 | 3,053 | 2,384 | 10k+ | | | Non Singular String Literal Domain |
| #102 | Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions | 23 | 1,131 | 1,913 | 9k+ | | | Output is not escaped |
| #103 | پارسی دیت – Parsi Date | 23 | 102 | 289 | 100k+ | | | Non-prefixed hook name |
| #104 | Subscribe Forms – Beautiful Email Forms, Embedded Newsletter Forms & MailChimp Form | 23 | 419 | 542 | 2k+ | | | Non-prefixed global variable |
| #105 | WP Ultimate CSV Importer – WordPress Import & Export for CSV, XML & Excel | 23 | 1,119 | 3,516 | 20k+ | | | Interpolated SQL is not prepared |
| #106 | Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress | 23 | 2,317 | 1,714 | 5k+ | | | Output is not escaped |
| #107 | AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress | 24 | 5,230 | 1,464 | 7k+ | | | Output is not escaped |
| #108 | Advanced iFrame | 24 | 887 | 1,120 | 40k+ | | | Non-prefixed global variable |
| #109 | Auto-Install Free SSL – Generate & Install Free SSL Certificates | 24 | 991 | 1,495 | 8k+ | | | Non-prefixed global variable |
| #110 | Backuply – Backup, Restore, Migrate and Clone | 24 | 704 | 551 | 700k+ | | | Non-prefixed global variable |
| #111 | Business Essentials for Contact Form 7 | 24 | 674 | 403 | 8k+ | | | Text Domain Mismatch |
| #112 | Smart Online Order for Clover | 24 | 1,746 | 1,246 | 1k+ | | | Text Domain Mismatch |
| #113 | CM Pop-Up – Create engaging popups to capture attention and boost interaction | 24 | 466 | 408 | 8k+ | | | Output is not escaped |
| #114 | Customer Reviews for WooCommerce | 24 | 2,206 | 2,443 | 80k+ | | | Output is not escaped |
| #115 | Enable Media Replace | 24 | 214 | 276 | 600k+ | | | Output is not escaped |
| #116 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder | 24 | 826 | 1,314 | 600k+ | | | Non-prefixed global variable |
| #117 | FV Simpler SEO | 24 | 766 | 308 | 2k+ | | | Text Domain Mismatch |
| #118 | Photo Gallery – Responsive Image Galleries by Supsystic | 24 | 240 | 91 | 20k+ | | | Text Domain Mismatch |
| #119 | InstaWP Connect – 1-click WP Staging & Migration | 24 | 253 | 811 | 40k+ | | | Non-prefixed global variable |
| #120 | Generate Images (AI) – Magic Post Thumbnail | 24 | 1,940 | 1,761 | 6k+ | | | Non-prefixed global variable |
| #121 | Mailchimp for WooCommerce | 24 | 523 | 663 | 200k+ | | | Non-prefixed global variable |
| #122 | Mailjet Email Marketing | 24 | 435 | 206 | 10k+ | | | Unsafe printing function |
| #123 | MxChat – AI Chatbot & Content Generation for WordPress | 24 | 3,157 | 1,385 | 2k+ | | | Text Domain Mismatch |
| #124 | PixelYourSite – Your smart PIXEL (TAG) & API Manager | 24 | 1,160 | 2,407 | 500k+ | | | Non-prefixed namespace |
| #125 | Premium Blocks – Gutenberg Blocks, Patterns & Templates | 24 | 140 | 308 | 2k+ | | | Non-prefixed function |
| #126 | Pz-LinkCard | 24 | 951 | 1,581 | 20k+ | | | Non-prefixed global variable |
| #127 | reGenerate Thumbnails Advanced | 24 | 220 | 122 | 70k+ | | | Unsafe printing function |
| #128 | Sailthru for WordPress | 24 | 239 | 266 | 2k+ | | | Non-prefixed global variable |
| #129 | Security Plugin, Firewall & Malware Scanner with Auto Removal | 24 | 1,192 | 770 | 30k+ | | | Output is not escaped |
| #130 | Simple Membership | 24 | 2,373 | 1,789 | 40k+ | | | Unsafe printing function |
| #131 | SKT Templates – 100% Free Templates for Elementor & Gutenberg | 24 | 553 | 1,353 | 20k+ | | | Non-prefixed global variable |
| #132 | MoreConvert Wishlist for WooCommerce | 24 | 3,678 | 629 | 9k+ | | | Text Domain Mismatch |
| #133 | Social Media Auto Publish | 24 | 1,468 | 713 | 6k+ | | | Unsafe printing function |
| #134 | Stripe Payment Forms by WP Simple Pay – Accept Credit Card Payments + Subscriptions with Stripe | 24 | 634 | 652 | 9k+ | | | Exception output is not escaped |
| #135 | User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder | 24 | 664 | 3,318 | 60k+ | | | Non-prefixed global variable |
| #136 | PDF Ink Lite – Free PDF Watermark & Password Protection | 24 | 226 | 561 | 2k+ | | | Non-prefixed global variable |
| #137 | WCMultiShipping — Mondial Relay, Inpost & Chronopost for WooCommerce | 24 | 730 | 499 | 5k+ | | | Output is not escaped |
| #138 | WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors | 24 | 168 | 584 | 4k+ | | | Non-prefixed class |
| #139 | Payment Gateway for PayPal on WooCommerce | 24 | 153 | 561 | 10k+ | | | Nonce verification recommended |
| #140 | pensopay Payments | 24 | 397 | 246 | 2k+ | | | Output is not escaped |
| #141 | European VAT Compliance Assistant for WooCommerce | 24 | 515 | 317 | 3k+ | | | Output is not escaped |
| #142 | WP RSS Aggregator – RSS Import, Feed to Post, Autoblogging, AI Content | 24 | 1,775 | 393 | 40k+ | | | Text Domain Mismatch |
| #143 | SchedulePress – Auto Post & Publish, Auto Social Share, Schedule Posts with Editorial Calendar & Missed Schedule Post Publisher | 24 | 296 | 245 | 10k+ | | | Output is not escaped |
| #144 | SlimStat Analytics | 24 | 1,169 | 737 | 70k+ | | | Exception output is not escaped |
| #145 | WP Travel – Ultimate Travel Booking System, Tour Management Engine | 24 | 226 | 1,951 | 4k+ | | | Non-prefixed hook name |
| #146 | WP Travel Engine – Tour Booking Plugin – Tour Operator Software | 24 | 2,010 | 5,688 | 20k+ | | | Non-prefixed global variable |
| #147 | WP User Manager – User Profile Builder & Membership | 24 | 787 | 539 | 10k+ | | | Exception output is not escaped |
| #148 | WPSpeed – WordPress Speed, Cache & Performance Optimization (Core Web Vitals, PageSpeed 100) | 24 | 482 | 189 | 2k+ | | | Output is not escaped |
| #149 | WpStream – Live Streaming, Video on Demand, Pay Per View | 24 | 1,712 | 740 | 4k+ | | | Text Domain Mismatch |
| #150 | Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid | 25 | 243 | 854 | 50k+ | | | Non-prefixed global variable |