| #1 | Scrollsequence – Cinematic Scroll Image Animation Plugin | 19 | 878 | 1,528 | 3k+ | | | Non-prefixed global variable |
| #2 | Event Espresso – Event Registration & Ticketing Sales | 21 | 12,710 | 2,136 | 600 | | | Text Domain Mismatch |
| #3 | Campaign Monitor for WordPress | 21 | 386 | 461 | 2k+ | | | Non-prefixed global variable |
| #4 | Revive Social – Social Media Auto Post and Scheduling Automation Plugin | 21 | 254 | 435 | 20k+ | | | Non-prefixed hook name |
| #5 | Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer | 22 | 2,854 | 1,269 | 40k+ | | | Text Domain Mismatch |
| #6 | easyReservations | 22 | 5,307 | 2,480 | 700 | | | Text Domain Mismatch |
| #7 | oik | 22 | 487 | 180 | 2k+ | | | Non Singular String Literal Domain |
| #8 | Slim Jetpack | 22 | 2,586 | 1,947 | 2k+ | | | Text Domain Mismatch |
| #9 | 10Web Booster – Website speed optimization, Cache & Page Speed optimizer | 22 | 503 | 599 | 70k+ | | | Non-prefixed global variable |
| #10 | SchedulePress – Auto Post & Publish, Auto Social Share, Schedule Posts with Editorial Calendar & Missed Schedule Post Publisher | 22 | 316 | 253 | 10k+ | | | Output is not escaped |
| #11 | WPSSO Core – Complete Schema Markup and Meta Tags | 22 | 1,426 | 416 | 4k+ | | | Missing Translators Comment |
| #12 | Booking calendar, Appointment Booking System | 23 | 1,079 | 1,125 | 3k+ | | | Output is not escaped |
| #13 | Geo Controller | 23 | 87 | 484 | 1k+ | | | Non-prefixed global variable |
| #14 | Easy Digital Downloads – eCommerce Payments and Subscriptions made easy | 23 | 3,702 | 8,486 | 40k+ | | | Non-prefixed namespace |
| #15 | Flexmls® IDX Plugin | 23 | 1,270 | 1,044 | 1k+ | | | Output is not escaped |
| #16 | Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress | 23 | 931 | 1,247 | 10k+ | | | Output is not escaped |
| #17 | Order Bump for WooCommerce | 23 | 1,720 | 1,562 | 600 | | | Output is not escaped |
| #18 | Next Active Directory Integration | 23 | 693 | 285 | 2k+ | | | Exception output is not escaped |
| #19 | Smart Marketing SMS and Newsletters Forms | 23 | 2,231 | 1,017 | 1k+ | | | Text Domain Mismatch |
| #20 | Ultimate Fields | 23 | 371 | 458 | 500 | | | Alternative PHP tag found |
| #21 | Affiliates Manager | 24 | 1,258 | 653 | 8k+ | | | Unsafe printing function |
| #22 | Backuply – Backup, Restore, Migrate and Clone | 24 | 729 | 553 | 600k+ | | | Non-prefixed global variable |
| #23 | WPBot – ChatBot Conversational Forms | 24 | 965 | 1,089 | 1k+ | | | Text Domain Mismatch |
| #24 | Newsletter – Send awesome emails from WordPress | 24 | 894 | 2,242 | 200k+ | | | Non-prefixed global variable |
| #25 | Ninja Forms – The Contact Form Builder That Grows With You | 24 | 709 | 1,596 | 600k+ | | | Nonce verification recommended |
| #26 | The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce | 24 | 11,733 | 509 | 100k+ | | | Text Domain Mismatch |
| #27 | Social Media Share Buttons & Social Sharing Icons | 24 | 2,432 | 1,364 | 100k+ | | | Unsafe printing function |
| #28 | WP Fastest Cache – WordPress Cache Plugin | 24 | 545 | 736 | 1m+ | | | Unsafe printing function |
| #29 | WP User Manager – User Profile Builder & Membership | 24 | 787 | 539 | 10k+ | | | Exception output is not escaped |
| #30 | Affiliates | 25 | 689 | 1,483 | 2k+ | | | Output is not escaped |
| #31 | Quttera ThreatSign – Web Malware Scanner for WordPress | 25 | 334 | 472 | 10k+ | | | Non-prefixed global variable |
| #32 | Recipe Card Blocks Lite | 25 | 287 | 683 | 10k+ | | | Non-prefixed global variable |
| #33 | Social Share Icons & Social Share Buttons | 25 | 2,350 | 1,328 | 10k+ | | | Output is not escaped |
| #34 | Crowdsignal Dashboard – Polls, Surveys & more | 26 | 481 | 491 | 200k+ | | | Unsafe printing function |
| #35 | Sign-up Sheets | 27 | 348 | 358 | 1k+ | | | Output is not escaped |
| #36 | Worthy – VG WORT Integration für WordPress | 27 | 1,343 | 773 | 1k+ | | | Output is not escaped |
| #37 | Booking Manager – Sync WP Booking Calendar – Import Events, Export Bookings to ICS Calendar | 28 | 521 | 227 | 5k+ | | | Output is not escaped |
| #38 | Darklup – Enhanced WordPress Dark Mode, Dark Theme, Night Mode & Accessibility Plugin | 28 | 648 | 86 | 1k+ | | | Text Domain Mismatch |
| #39 | Post Views Counter | 28 | 191 | 415 | 200k+ | | | Non-prefixed hook name |
| #40 | Secure Downloads | 28 | 616 | 406 | 600 | | | Output is not escaped |
| #41 | 10WebSocial | 28 | 584 | 185 | 10k+ | | | Unsafe printing function |
| #42 | Cookie Compliance for WordPress – Cookie Consent, GDPR & CCPA | 30 | 154 | 353 | 900k+ | | | Missing nonce verification |
| #43 | User Access Manager | 30 | 403 | 177 | 10k+ | | | Output is not escaped |
| #44 | Persian Admnin Fonts | 31 | 353 | 556 | 500 | | | Non-prefixed global variable |
| #45 | Ultimate Posts Widget | 31 | 309 | 86 | 10k+ | | | Output is not escaped |
| #46 | Download Attachments | 32 | 69 | 188 | 8k+ | | | Non-prefixed hook name |
| #47 | Agile CRM | 33 | 163 | 81 | 500 | | | wp function not compatible with requires wp |
| #48 | ImageLinks – Interactive Image Builder with Hotspots | 33 | 517 | 90 | 1k+ | | | Text Domain Mismatch |
| #49 | Login with Vipps and MobilePay | 33 | 272 | 179 | 800 | | | Output is not escaped |
| #50 | Enhanced Text Widget | 34 | 101 | 58 | 30k+ | | | Output is not escaped |