| #201 | WP Travel – Ultimate Travel Booking System, Tour Management Engine | 24 | 225 | 1,943 | 4k+ | | | Non-prefixed hook name |
| #202 | WP Travel Engine – Tour Booking Plugin – Tour Operator Software | 24 | 2,010 | 5,688 | 20k+ | | | Non-prefixed global variable |
| #203 | WP User Manager – User Profile Builder & Membership | 24 | 787 | 539 | 10k+ | | | Exception output is not escaped |
| #204 | WPSpeed – WordPress Speed, Cache & Performance Optimization (Core Web Vitals, PageSpeed 100) | 24 | 482 | 189 | 2k+ | | | Output is not escaped |
| #205 | WpStream – Live Streaming, Video on Demand, Pay Per View | 24 | 1,724 | 739 | 3k+ | | | Text Domain Mismatch |
| #206 | Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid | 25 | 243 | 854 | 50k+ | | | Non-prefixed global variable |
| #207 | Booking Package | 25 | 1,700 | 3,977 | 10k+ | | | Missing nonce verification |
| #208 | Breeze Cache | 25 | 218 | 800 | 400k+ | | | Non-prefixed global variable |
| #209 | Broken Link Checker | 25 | 727 | 600 | 500k+ | | | Output is not escaped |
| #210 | CheckoutWC Lite | 25 | 1,399 | 851 | 3k+ | | | Text Domain Mismatch |
| #211 | HIPAA FORMS | 25 | 414 | 416 | 800 | | | Request data is not unslashed |
| #212 | Colissimo shipping methods for WooCommerce | 25 | 1,755 | 557 | 10k+ | | | Text Domain Mismatch |
| #213 | DecaLog | 25 | 943 | 236 | 1k+ | | | Exception output is not escaped |
| #214 | Demo Importer Plus | 25 | 58 | 239 | 10k+ | | | Non-prefixed hook name |
| #215 | WEB-Translation – eTranslation Multilingual | 25 | 217 | 1,057 | 400 | | | Non-prefixed function |
| #216 | Events Made Easy | 25 | 507 | 6,299 | 1k+ | | | Non-prefixed function |
| #217 | Site Kit by Google – Analytics, Search Console, AdSense, Speed | 25 | 1,304 | 242 | 5m+ | | | Missing direct file access protection |
| #218 | Sitemap by BestWebSoft – WordPress XML Site Map Page Generator Plugin | 25 | 608 | 207 | 20k+ | | | Text Domain Mismatch |
| #219 | Hardcore Google Fonts Localizer | 25 | 331 | 261 | 900 | | | Text Domain Mismatch |
| #220 | Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force Prevention | 25 | 618 | 605 | 1m+ | | | Unsafe printing function |
| #221 | Loginizer | 25 | 814 | 504 | 1m+ | | | Output is not escaped |
| #222 | LWS Optimize – All-in-One Speed Booster & Cache Tools | 25 | 430 | 764 | 20k+ | | | Non-prefixed global variable |
| #223 | MyFatoorah – WooCommerce | 25 | 191 | 89 | 3k+ | | | Output is not escaped |
| #224 | Object Sync for Salesforce | 25 | 192 | 296 | 500 | | | Non-prefixed global variable |
| #225 | phpinfo() WP — Site Health, PHP Compatibility & Server Audit | 25 | 276 | 704 | 3k+ | | | Non-prefixed global variable |
| #226 | reSmush.it : The original free image compressor and optimizer plugin | 25 | 155 | 69 | 100k+ | | | Output is not escaped |
| #227 | BerqWP – All-In-One Optimization for Core Web Vitals, Cache, CDN, Images, CSS & JavaScript | 25 | 198 | 501 | 3k+ | | | Non-prefixed global variable |
| #228 | ShopMagic – email automation | 25 | 228 | 145 | 10k+ | | | Exception output is not escaped |
| #229 | Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin | 25 | 960 | 738 | 60k+ | | | Text Domain Mismatch |
| #230 | Tamara Checkout | 25 | 601 | 228 | 2k+ | | | Exception output is not escaped |
| #231 | Social Media Share Buttons & Social Sharing Icons | 25 | 2,433 | 1,383 | 100k+ | | | Unsafe printing function |
| #232 | Social Share Icons & Social Share Buttons | 25 | 2,365 | 1,357 | 10k+ | | | Output is not escaped |
| #233 | VikAppointments Services Booking Calendar | 25 | 9,753 | 5,207 | 500 | | | Output is not escaped |
| #234 | VikBooking Hotel Booking Engine & PMS | 25 | 13,232 | 8,312 | 8k+ | | | Output is not escaped |
| #235 | VikRentCar Car Rental Management System | 25 | 5,537 | 5,048 | 4k+ | | | Non-prefixed global variable |
| #236 | VikRestaurants Table Reservations and Take-Away | 25 | 11,644 | 4,932 | 600 | | | Output is not escaped |
| #237 | WP Review Slider | 25 | 1,186 | 2,279 | 6k+ | | | Non-prefixed global variable |
| #238 | WP Encryption – No.1 HTTPS plugin & One Click Free SSL Cert, HTTPS Redirect, Security | 25 | 727 | 1,554 | 50k+ | | | Non-prefixed global variable |
| #239 | SlimStat Analytics | 25 | 1,177 | 870 | 70k+ | | | Exception output is not escaped |
| #240 | WP Statistics – Simple, privacy-friendly Google Analytics alternative | 25 | 610 | 2,465 | 600k+ | | | Non-prefixed global variable |
| #241 | WPvivid Backup for MainWP | 25 | 818 | 1,794 | 10k+ | | | Missing nonce verification |
| #242 | WPvivid — Backup, Migration & Staging | 25 | 899 | 1,461 | 900k+ | | | Non-prefixed namespace |
| #243 | Translate WordPress with ConveyThis – AI Multilingual Plugin | 26 | 159 | 297 | 1k+ | | | Non-prefixed global variable |
| #244 | Accept Donations with PayPal & Stripe | 26 | 916 | 572 | 10k+ | | | Unsafe printing function |
| #245 | RSS Redirect & Feedburner Alternative | 26 | 277 | 272 | 1k+ | | | Output is not escaped |
| #246 | FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) | 26 | 591 | 416 | 2k+ | | | Exception output is not escaped |
| #247 | FV Antispam | 26 | 332 | 239 | 900 | | | Output is not escaped |
| #248 | Translate WordPress – Google Language Translator | 26 | 200 | 317 | 100k+ | | | Non-prefixed global variable |
| #249 | GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites | 26 | 284 | 216 | 500 | | | badly named files |
| #250 | Integrate Razorpay for Contact Form 7 | 26 | 152 | 97 | 500 | | | curl curl setopt |