| #151 | Import and export users and customers | 24 | 1,027 | 360 | 70k+ | | | Unsafe printing function |
| #152 | Kirki – Freeform Page Builder, Website Builder & Customizer | 24 | 218 | 816 | 500k+ | | | Exception output is not escaped |
| #153 | KiviCare – Clinic & Patient Management System (EHR) | 24 | 223 | 881 | 2k+ | | | Direct Query |
| #154 | Koko Analytics – Privacy-Friendly WordPress Analytics | 24 | 166 | 398 | 60k+ | | | Short PHP open tag found |
| #155 | Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress | 24 | 1,876 | 957 | 100k+ | | | Output is not escaped |
| #156 | LearnPress – Backup & Migration Tool | 24 | 385 | 469 | 5k+ | | | Output is not escaped |
| #157 | LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes | 24 | 407 | 1,192 | 10k+ | | | Non-prefixed global variable |
| #158 | Media Library Folders | 24 | 889 | 807 | 10k+ | | | Text Domain Mismatch |
| #159 | My Agile Privacy® – CMP, Cookie Consent & Privacy Tools | 24 | 1,329 | 705 | 7k+ | | | Text Domain Mismatch |
| #160 | Nexter Extension – Security, Performance, Code Snippets & Site Toolkit | 24 | 175 | 762 | 10k+ | | | Nonce verification recommended |
| #161 | Ninja Forms – The Contact Form Builder That Grows With You | 24 | 752 | 1,599 | 600k+ | | | Nonce verification recommended |
| #162 | Patchstack – WordPress & Plugins Security | 24 | 104 | 478 | 50k+ | | | Missing nonce verification |
| #163 | PDF Generator for WordPress Elementor | 24 | 513 | 271 | 1k+ | | | Exception output is not escaped |
| #164 | Database Manager – WP Adminer | 24 | 1,005 | 2,752 | 20k+ | | | Non-prefixed global variable |
| #165 | PixelYourSite – Your smart PIXEL (TAG) & API Manager | 24 | 1,578 | 2,900 | 500k+ | | | Non-prefixed namespace |
| #166 | Post Status Notifier Lite | 24 | 984 | 451 | 700 | | | Missing direct file access protection |
| #167 | Pricing Table by Supsystic | 24 | 1,227 | 440 | 10k+ | | | Non Singular String Literal Domain |
| #168 | Product Watermark for WooCommerce | 24 | 685 | 459 | 2k+ | | | Text Domain Mismatch |
| #169 | SecuPress with Simple SSL – Simple and Performant Security | 24 | 1,695 | 1,600 | 40k+ | | | Non-prefixed global variable |
| #170 | ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization | 24 | 926 | 322 | 10k+ | | | Output is not escaped |
| #171 | SiteGuard WP Plugin | 24 | 359 | 352 | 600k+ | | | Output is not escaped |
| #172 | Softaculous | 24 | 115 | 50 | 10k+ | | | file system operations fread |
| #173 | GEO Plugin by Squirrly SEO | 24 | 1,191 | 231 | 30k+ | | | Missing Translators Comment |
| #174 | Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers | 24 | 361 | 1,483 | 1k+ | | | Nonce verification recommended |
| #175 | Tainacan | 24 | 138 | 592 | 1k+ | | | Direct Query |
| #176 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin | 24 | 938 | 2,935 | 200k+ | | | Non-prefixed global variable |
| #177 | User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder | 24 | 667 | 3,385 | 50k+ | | | Non-prefixed global variable |
| #178 | Vimeography: Vimeo Video Gallery WordPress Plugin | 24 | 98 | 212 | 5k+ | | | Nonce verification recommended |
| #179 | Visitor Traffic Real Time Statistics | 24 | 470 | 927 | 30k+ | | | Non-prefixed global variable |
| #180 | WPML Multilingual & Multicurrency for WooCommerce | 24 | 1,599 | 1,691 | 100k+ | | | SQL query is not prepared |
| #181 | WP-Appbox | 24 | 418 | 390 | 2k+ | | | Missing Arg Domain |
| #182 | WP Fastest Cache – WordPress Cache Plugin | 24 | 541 | 753 | 1m+ | | | Unsafe printing function |
| #183 | WP Encryption – Lifetime Free SSL Cert & HTTPS, Force SSL / HTTPS Redirect, SSL Security | 24 | 728 | 1,556 | 50k+ | | | Non-prefixed global variable |
| #184 | WP-Members Membership Plugin | 24 | 669 | 382 | 50k+ | | | Output is not escaped |
| #185 | WP RSS Aggregator – RSS Import, Feed to Post, Autoblogging, AI Content | 24 | 1,774 | 398 | 40k+ | | | Text Domain Mismatch |
| #186 | WP Travel Engine – Tour Booking Plugin – Tour Operator Software | 24 | 2,030 | 5,704 | 20k+ | | | Non-prefixed global variable |
| #187 | WPAdverts – Classifieds Plugin | 24 | 1,308 | 496 | 4k+ | | | Output is not escaped |
| #188 | xili-language | 24 | 1,501 | 523 | 600 | | | Output is not escaped |
| #189 | Jetpack CRM – Clients, Leads, Invoices, Billing, Email Marketing, & Automation | 24 | 1,211 | 3,153 | 30k+ | | | Non-prefixed global variable |
| #190 | 3DPrint Lite | 25 | 175 | 1,029 | 700 | | | Non-prefixed global variable |
| #191 | ActiveCampaign for WooCommerce | 25 | 566 | 194 | 5k+ | | | Non Singular String Literal Domain |
| #192 | AliExpress Dropshipping Plugin for WooCommerce Stores | 25 | 555 | 734 | 4k+ | | | Text Domain Mismatch |
| #193 | Booking for Appointments and Events Calendar – Amelia | 25 | 1,512 | 553 | 90k+ | | | Exception output is not escaped |
| #194 | Online Scheduling and Appointment Booking System – Bookly | 25 | 1,095 | 900 | 60k+ | | | SQL query is not prepared |
| #195 | Breeze Cache | 25 | 219 | 802 | 400k+ | | | Non-prefixed global variable |
| #196 | Kognetiks Chatbot for WordPress | 25 | 681 | 1,510 | 600 | | | Non-prefixed global variable |
| #197 | Docket Cache – Object Cache Accelerator | 25 | 333 | 481 | 20k+ | | | Output is not escaped |
| #198 | Featured Image from URL (FIFU) | 25 | 2,042 | 1,009 | 70k+ | | | Non Singular String Literal Domain |
| #199 | HT Contact Form – Drag & Drop Form Builder for WordPress | 25 | 158 | 597 | 10k+ | | | Non-prefixed global variable |
| #200 | Image SEO – AI-Driven Image SEO Optimizer | 25 | 350 | 328 | 1k+ | | | Text Domain Mismatch |