| #101 | Feed Them Social – Social Media Feeds, Video, and Photo Galleries | 23 | 563 | 535 | 20k+ | | | Output is not escaped |
| #102 | Image Photo Gallery Final Tiles Grid | 23 | 578 | 1,502 | 20k+ | | | Non-prefixed global variable |
| #103 | Tracking and Consent Manager – WP Full Picture | 23 | 1,280 | 3,223 | 3k+ | | | Non-prefixed global variable |
| #104 | FV Flowplayer Video Player | 23 | 1,311 | 1,454 | 20k+ | | | Output is not escaped |
| #105 | GAinWP Google Analytics Integration for WordPress | 23 | 525 | 176 | 8k+ | | | Output is not escaped |
| #106 | Gmedia Photo Gallery | 23 | 350 | 1,121 | 7k+ | | | Non-prefixed global variable |
| #107 | Interactive Content – H5P | 23 | 565 | 380 | 40k+ | | | Non Singular String Literal Domain |
| #108 | Happy Addons for Elementor | 23 | 573 | 444 | 400k+ | | | Output is not escaped |
| #109 | King Addons for Elementor – 80+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce, Mega Menu, Popup Builder | 23 | 1,837 | 3,878 | 10k+ | | | Non-prefixed global variable |
| #110 | KiviCare – Clinic & Patient Management System (EHR) | 23 | 206 | 850 | 2k+ | | | Direct Query |
| #111 | Link Whisper Free | 23 | 3,882 | 5,303 | 30k+ | | | Text Domain Mismatch |
| #112 | MailPoet – Newsletters, Email Marketing, and Automation | 23 | 926 | 710 | 500k+ | | | Exception output is not escaped |
| #113 | Media Library Assistant | 23 | 1,144 | 3,943 | 70k+ | | | Nonce verification recommended |
| #114 | MStore API – Create Native Android & iOS Apps On The Cloud | 23 | 618 | 764 | 3k+ | | | SQL query is not prepared |
| #115 | MultiParcels Shipping For WooCommerce | 23 | 177 | 383 | 4k+ | | | Request data is not unslashed |
| #116 | MyWorks Sync for WooCommerce & QuickBooks Online | 23 | 2,292 | 9,101 | 5k+ | | | Non-prefixed global variable |
| #117 | Ocean Extra | 23 | 1,494 | 2,106 | 500k+ | | | Non-prefixed global variable |
| #118 | Patchstack – WordPress & Plugins Security | 23 | 107 | 489 | 40k+ | | | Missing nonce verification |
| #119 | Photo Gallery by 10Web – Mobile-Friendly Image Gallery | 23 | 4,159 | 1,553 | 100k+ | | | Output is not escaped |
| #120 | PowerPress Podcasting plugin by Blubrry | 23 | 4,807 | 2,394 | 20k+ | | | Output is not escaped |
| #121 | Redirection | 23 | 523 | 457 | 100k+ | | | Non-prefixed global variable |
| #122 | Robo Gallery – Photo & Image Slider | 23 | 1,291 | 530 | 40k+ | | | Output is not escaped |
| #123 | SecuPress with Simple SSL – Simple and Performant Security | 23 | 1,696 | 1,590 | 40k+ | | | Non-prefixed global variable |
| #124 | Simple URLs – Link Cloaking, Product Displays, and Affiliate Link Management | 23 | 295 | 298 | 4k+ | | | Non-prefixed global variable |
| #125 | Slider Hero with Video Background, Animation | 23 | 1,565 | 1,253 | 3k+ | | | Text Domain Mismatch |
| #126 | Slider by 10Web – Responsive Image Slider | 23 | 5,814 | 976 | 10k+ | | | Output is not escaped |
| #127 | teachPress | 23 | 744 | 1,587 | 2k+ | | | SQL query is not prepared |
| #128 | The Events Calendar | 23 | 3,512 | 3,848 | 700k+ | | | Text Domain Mismatch |
| #129 | The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid | 23 | 105 | 1,013 | 100k+ | | | Non-prefixed global variable |
| #130 | Trinity Audio – Text to Speech AI audio player to convert content into audio | 23 | 119 | 227 | 2k+ | | | Non-prefixed global variable |
| #131 | UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP | 23 | 695 | 2,434 | 20k+ | | | Non-prefixed hook name |
| #132 | VK All in One Expansion Unit | 23 | 1,026 | 518 | 100k+ | | | Output is not escaped |
| #133 | Product Table & List Builder For WooCommerce | 23 | 1,361 | 2,059 | 10k+ | | | Non-prefixed global variable |
| #134 | ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin | 23 | 7,423 | 2,181 | 90k+ | | | Text Domain Mismatch |
| #135 | Clone | 23 | 244 | 262 | 40k+ | | | Output is not escaped |
| #136 | WP Crowdfunding | 23 | 199 | 1,629 | 2k+ | | | Non-prefixed global variable |
| #137 | WP STAGING – WordPress Backup, Migration, Clone & Duplicate | 23 | 1,489 | 1,549 | 100k+ | | | Non-prefixed global variable |
| #138 | WP Ultimate CSV Importer – WordPress Import & Export for CSV, XML & Excel | 23 | 1,119 | 3,516 | 20k+ | | | Interpolated SQL is not prepared |
| #139 | WPMobile.App | 23 | 2,983 | 1,527 | 3k+ | | | Output is not escaped |
| #140 | Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress | 23 | 2,317 | 1,714 | 5k+ | | | Output is not escaped |
| #141 | AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress | 24 | 5,230 | 1,464 | 7k+ | | | Output is not escaped |
| #142 | Ad Inserter – Ad Manager & AdSense Ads | 24 | 4,241 | 811 | 300k+ | | | Output is not escaped |
| #143 | Advanced iFrame | 24 | 887 | 1,120 | 40k+ | | | Non-prefixed global variable |
| #144 | Affiliates Manager | 24 | 1,268 | 653 | 9k+ | | | Unsafe printing function |
| #145 | Auto-Install Free SSL – Generate & Install Free SSL Certificates | 24 | 991 | 1,495 | 8k+ | | | Non-prefixed global variable |
| #146 | TermsFeed AutoTerms: Privacy Policy Generator, Cookie Consent, GDPR, CCPA, Terms & Conditions, Disclaimers, Cookies Policy, EULA | 24 | 939 | 161 | 70k+ | | | Non Singular String Literal Domain |
| #147 | Awesome Support – WordPress HelpDesk & Support Plugin | 24 | 225 | 1,239 | 6k+ | | | Non-prefixed global variable |
| #148 | Blog Designer Pack – Blog, Post Grid, Post Slider, Post Carousel, Category Post, News | 24 | 699 | 1,693 | 30k+ | | | Non-prefixed global variable |
| #149 | Branda – White Label & Branding, Free Login Page Customizer | 24 | 3,174 | 820 | 20k+ | | | Text Domain Mismatch |
| #150 | Buttonizer – Floating Menus, Sticky Buttons, & Popup Builder | 24 | 576 | 1,344 | 70k+ | | | Non-prefixed global variable |