| #1 | BulletProof Security | 0 | 5,048 | 4,949 | 20k+ | | | Output is not escaped |
| #2 | WPtouch – Make your WordPress Website Mobile-Friendly | 17 | 1,466 | 325 | 50k+ | | | Text Domain Mismatch |
| #3 | WPPizza – A Restaurant Plugin | 18 | 4,689 | 2,703 | 1k+ | | | Text Domain Mismatch |
| #4 | Robin Image Optimizer – Unlimited Image Optimization, WebP & AVIF | 20 | 556 | 543 | 100k+ | | | Output is not escaped |
| #5 | Booking Ultra Pro Appointments Booking Calendar Plugin | 21 | 761 | 2,083 | 400 | | | Request data is not unslashed |
| #6 | Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More | 21 | 2,572 | 1,277 | 1m+ | | | Output is not escaped |
| #7 | Wordfence Security – Firewall, Malware Scan, and Login Security | 21 | 1,818 | 3,236 | 5m+ | | | Output is not escaped |
| #8 | Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer | 22 | 2,854 | 1,269 | 50k+ | | | Text Domain Mismatch |
| #9 | SSL Zen — SSL Certificate Installer & HTTPS Redirects | 22 | 751 | 1,605 | 10k+ | | | Non-prefixed global variable |
| #10 | GAinWP Google Analytics Integration for WordPress | 23 | 525 | 176 | 8k+ | | | Output is not escaped |
| #11 | Next Active Directory Integration | 23 | 683 | 284 | 2k+ | | | Exception output is not escaped |
| #12 | AI Popup | 23 | 1,224 | 636 | 400 | | | Text Domain Mismatch |
| #13 | Local Google Analytics for WordPress – caches external requests | 23 | 551 | 199 | 3k+ | | | Output is not escaped |
| #14 | NextScripts: Social Networks Auto-Poster | 23 | 2,232 | 1,014 | 20k+ | | | Unsafe printing function |
| #15 | ManageWP Worker | 23 | 506 | 565 | 1m+ | | | Non-prefixed class |
| #16 | WP Migrate Lite – Migration Made Easy | 23 | 371 | 257 | 200k+ | | | Exception output is not escaped |
| #17 | Disable Admin Notices – Hide Dashboard Notifications | 24 | 464 | 195 | 100k+ | | | Output is not escaped |
| #18 | Assets manager, dequeue scripts, dequeue styles for WordPress | 24 | 592 | 255 | 2k+ | | | Output is not escaped |
| #19 | Social Slider Feed – Social Media Feed & Gallery Widgets | 24 | 927 | 706 | 10k+ | | | Non-prefixed global variable |
| #20 | Disable Updates – Updates Manager, Disable Automatic Updates, Disable All Updates | 24 | 521 | 134 | 10k+ | | | Output is not escaped |
| #21 | Disable Comments & Delete All Comments | 25 | 502 | 184 | 9k+ | | | Output is not escaped |
| #22 | Cryptocurrency Payment Gateway | 25 | 1,963 | 589 | 400 | | | Text Domain Mismatch |
| #23 | WP Popups – WordPress Popup builder | 25 | 440 | 342 | 30k+ | | | Output is not escaped |
| #24 | Cyrlitera – Transliteration of Links and File Names | 26 | 452 | 202 | 40k+ | | | Output is not escaped |
| #25 | Visitors Online by BestWebSoft | 26 | 512 | 269 | 1k+ | | | Text Domain Mismatch |
| #26 | BackUpWordPress | 27 | 245 | 271 | 80k+ | | | Non-prefixed global variable |
| #27 | Better Google Analytics | 29 | 376 | 869 | 2k+ | | | Non-prefixed global variable |
| #28 | Countdown, Coming Soon, Maintenance – Countdown & Clock | 29 | 1,735 | 143 | 10k+ | | | Non Singular String Literal Domain |
| #29 | Analytics Insights – Google Analytics Dashboard for WordPress | 30 | 241 | 170 | 10k+ | | | Unsafe printing function |
| #30 | Popup Builder – Create highly converting, mobile friendly marketing popups. | 30 | 28 | 722 | 200k+ | | | Non-prefixed global variable |
| #31 | Rublon Multi-Factor Authentication (MFA) | 30 | 216 | 160 | 400 | | | Output is not escaped |
| #32 | User Avatar – Reloaded | 30 | 352 | 171 | 900 | | | Text Domain Mismatch |
| #33 | Affiliate Coupons – Coupon Display Manager – Excellent Tool for Affiliate Marketers | 32 | 183 | 61 | 1k+ | | | Output is not escaped |
| #34 | Quick Featured Images | 32 | 436 | 323 | 50k+ | | | Non-prefixed global variable |
| #35 | Companion Sitemap Generator – Simple, Smart, and SEO-Ready | 33 | 118 | 57 | 7k+ | | | Missing Translators Comment |
| #36 | Multi Step Form | 34 | 277 | 139 | 9k+ | | | Output is not escaped |
| #37 | One User Avatar | User Profile Picture | 34 | 68 | 190 | 100k+ | | | Non-prefixed global variable |
| #38 | Search Engine Insights for Google Search Console | 34 | 174 | 113 | 2k+ | | | Output is not escaped |
| #39 | Ultimate Post List | 35 | 186 | 84 | 2k+ | | | Missing Arg Domain |
| #40 | Recent Posts Widget With Thumbnails | 37 | 222 | 46 | 100k+ | | | Output is not escaped |
| #41 | ReCaptcha Integration for WordPress | 37 | 60 | 66 | 9k+ | | | Output is not escaped |
| #42 | Announce from the Dashboard | 38 | 138 | 24 | 7k+ | | | Non Singular String Literal Domain |
| #43 | WP REST API – OAuth 1.0a Server | 38 | 100 | 85 | 8k+ | | | Text Domain Mismatch |
| #44 | Content Visibility for Divi Builder | 39 | 184 | 59 | 2k+ | | | Non Singular String Literal Domain |
| #45 | WP Sitemaps Config | 39 | 88 | 37 | 700 | | | Output is not escaped |
| #46 | Categories Metabox Enhanced | 40 | 77 | 36 | 1k+ | | | Output is not escaped |
| #47 | Custom Spinner for Contact Form 7 | 42 | 36 | 11 | 1k+ | | | Output is not escaped |
| #48 | Custom Fields for Gutenberg | 42 | 24 | 24 | 1k+ | | | Output is not escaped |
| #49 | Speed Contact Bar | 42 | 53 | 20 | 4k+ | | | Output is not escaped |
| #50 | DoLogin Security | 43 | 61 | 7 | 7k+ | | | Exception output is not escaped |