| #1 | BulletProof Security | 0 | 5,048 | 4,949 | 20k+ | | | Output is not escaped |
| #2 | Intercom | 0 | 60 | 71 | 6k+ | | | Non-prefixed function |
| #3 | Live Shopping & Shoppable Videos For WooCommerce | 0 | 79 | 174 | 400 | | | Non-prefixed global variable |
| #4 | Themify Builder | 9 | 5,304 | 2,136 | 5k+ | | | Text Domain Mismatch |
| #5 | JetBackup – Backup, Restore & Migrate | 10 | 1,563 | 149 | 200k+ | | | Exception output is not escaped |
| #6 | Dynamic Team Manager – Team Member Showcase with grid, slider, table Elementor widget & shortcode | 17 | 922 | 2,014 | 900 | | | Non-prefixed global variable |
| #7 | WPtouch – Make your WordPress Website Mobile-Friendly | 17 | 1,466 | 325 | 50k+ | | | Text Domain Mismatch |
| #8 | Podlove Podcast Publisher | 18 | 2,354 | 1,433 | 3k+ | | | Output is not escaped |
| #9 | Realtyna Organic IDX plugin + WPL Real Estate | 18 | 930 | 3,636 | 2k+ | | | Non-prefixed global variable |
| #10 | Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution | 19 | 1,218 | 901 | 100k+ | | | Exception output is not escaped |
| #11 | Matomo Analytics – Powerful, Privacy-First Insights for WordPress | 19 | 1,900 | 877 | 100k+ | | | Exception output is not escaped |
| #12 | Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) | 19 | 536 | 379 | 3m+ | | | Missing Translators Comment |
| #13 | WP Import Export Lite | 19 | 737 | 979 | 40k+ | | | Non-prefixed global variable |
| #14 | Download Monitor | 20 | 423 | 1,364 | 80k+ | | | Non-prefixed hook name |
| #15 | MBE eShip | 20 | 527 | 740 | 1k+ | | | Non-prefixed global variable |
| #16 | Brevo – Email, SMS, Web Push, Chat, and more. | 20 | 460 | 646 | 100k+ | | | Request data is not unslashed |
| #17 | Microthemer Lite – Visual Editor to Customize CSS | 20 | 1,004 | 1,699 | 10k+ | | | Non-prefixed global variable |
| #18 | Premium Packages – Sell Digital Products Securely | 20 | 2,017 | 2,183 | 2k+ | | | Non-prefixed global variable |
| #19 | Backup Migration | 21 | 981 | 1,093 | 80k+ | | | Non-prefixed global variable |
| #20 | Kadence Security – Password, Two Factor Authentication, and Brute Force Protection | 21 | 1,060 | 957 | 700k+ | | | Missing Translators Comment |
| #21 | Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots | 21 | 1,621 | 2,038 | 10k+ | | | Direct Query |
| #22 | rtMedia for WordPress, BuddyPress and bbPress | 21 | 363 | 647 | 7k+ | | | Non-prefixed constant |
| #23 | CartFlows – Funnel Builder & Checkout Plugin for WooCommerce | 21 | 462 | 656 | 200k+ | | | Text Domain Mismatch |
| #24 | Comet Cache | 21 | 857 | 245 | 20k+ | | | Output is not escaped |
| #25 | Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More | 21 | 2,572 | 1,277 | 1m+ | | | Output is not escaped |
| #26 | eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams | 21 | 186 | 437 | 9k+ | | | Non-prefixed global variable |
| #27 | FileOrganizer – WordPress File Manager | 21 | 536 | 241 | 200k+ | | | unlink unlink |
| #28 | Filter Everything — WordPress & WooCommerce Filters | 21 | 643 | 933 | 50k+ | | | Non-prefixed global variable |
| #29 | Mergado Pack | 21 | 2,323 | 588 | 700 | | | Output is not escaped |
| #30 | User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor | 21 | 703 | 1,463 | 40k+ | | | Missing Translators Comment |
| #31 | Smart Forms – when you need more than just a contact form | 21 | 776 | 574 | 5k+ | | | Output is not escaped |
| #32 | Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin | 21 | 1,074 | 2,978 | 40k+ | | | Direct Query |
| #33 | UPC/EAN/GTIN Barcode Generator/Importer | 21 | 776 | 311 | 500 | | | Exception output is not escaped |
| #34 | WebP Express | 21 | 160 | 427 | 300k+ | | | Non-prefixed global variable |
| #35 | WooCommerce | 21 | 1,343 | 6,212 | 7m+ | | | Non-prefixed global variable |
| #36 | PPOM – Product Addons & Custom Fields for WooCommerce | 21 | 336 | 1,319 | 20k+ | | | Non-prefixed global variable |
| #37 | Wordfence Security – Firewall, Malware Scan, and Login Security | 21 | 1,592 | 2,973 | 5m+ | | | Output is not escaped |
| #38 | WP Compress – Instant Performance & Speed Optimization | 21 | 3,367 | 3,253 | 10k+ | | | Non Singular String Literal Domain |
| #39 | WP phpMyAdmin | 21 | 4,528 | 6,435 | 40k+ | | | Missing Arg Domain |
| #40 | wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin | 21 | 1,812 | 1,432 | 70k+ | | | Output is not escaped |
| #41 | WP Extended – The Ultimate WordPress Toolkit | 21 | 1,253 | 398 | 600 | | | Non Singular String Literal Domain |
| #42 | WebTotem Security | 21 | 1,110 | 213 | 800 | | | Text Domain Mismatch |
| #43 | Borderless – Addons and Templates for Elementor | 22 | 438 | 1,388 | 5k+ | | | Non-prefixed global variable |
| #44 | Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer | 22 | 2,854 | 1,269 | 50k+ | | | Text Domain Mismatch |
| #45 | Code Profiler – WordPress Performance Profiling and Debugging Made Easy | 22 | 265 | 400 | 8k+ | | | Non-prefixed global variable |
| #46 | Directorist: AI-Powered Business Directory, Listings & Classified Ads | 22 | 560 | 2,202 | 20k+ | | | Non-prefixed global variable |
| #47 | Download Manager | 22 | 2,513 | 1,459 | 100k+ | | | Output is not escaped |
| #48 | easyReservations | 22 | 5,307 | 2,480 | 800 | | | Text Domain Mismatch |
| #49 | Ebook Store | 22 | 410 | 1,054 | 700 | | | Non-prefixed global variable |
| #50 | File Manager Pro – Filester | 22 | 566 | 391 | 100k+ | | | Request data is not unslashed |