| #51 | Vimeography: Vimeo Video Gallery WordPress Plugin | 24 | 98 | 212 | 5k+ | | | Nonce verification recommended |
| #52 | WP Helper Premium | 24 | 4,000 | 1,590 | 1k+ | | | Text Domain Mismatch |
| #53 | WP-Stateless – Google Cloud Storage | 24 | 1,036 | 482 | 4k+ | | | Non Singular String Literal Domain |
| #54 | WP User Manager – User Profile Builder & Membership | 24 | 787 | 539 | 10k+ | | | Exception output is not escaped |
| #55 | Photo Engine (Media Organizer & Lightroom) | 24 | 253 | 645 | 2k+ | | | Direct Query |
| #56 | Lean Player – Video and Audio Player with Playlist for WordPress, Elementor and Gutenberg | 25 | 2,199 | 1,757 | 2k+ | | | Text Domain Mismatch |
| #57 | Cryptocurrency Payment Gateway | 25 | 1,963 | 589 | 400 | | | Text Domain Mismatch |
| #58 | Demo Importer Plus | 25 | 58 | 239 | 10k+ | | | Non-prefixed hook name |
| #59 | WEB-Translation – eTranslation Multilingual | 25 | 217 | 1,057 | 400 | | | Non-prefixed function |
| #60 | 胖鼠采集(Fat Rat Collect) | 25 | 630 | 190 | 900 | | | Missing Arg Domain |
| #61 | Gallery Images Ape | 25 | 588 | 341 | 1k+ | | | Output is not escaped |
| #62 | WPBruiser {no- Captcha anti-Spam} | 25 | 646 | 259 | 10k+ | | | Non Singular String Literal Domain |
| #63 | Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more | 25 | 4,019 | 1,265 | 2k+ | | | Text Domain Mismatch |
| #64 | Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails | 25 | 4,996 | 1,724 | 5k+ | | | Text Domain Mismatch |
| #65 | Smart Manager – Advanced WooCommerce Bulk Editor & Inventory Manager (Spreadsheet) | 25 | 367 | 924 | 10k+ | | | SQL query is not prepared |
| #66 | StoreGrowth – Upsell, BOGO, Quick View, Direct Checkout & Side Cart for WooCommerce | 25 | 127 | 441 | 2k+ | | | Non-prefixed global variable |
| #67 | TranslatePress – Translate Multilingual sites with AI Translation | 25 | 583 | 1,673 | 400k+ | | | Non-prefixed hook name |
| #68 | weForms – Easy Drag & Drop Contact Form Builder For WordPress | 25 | 916 | 450 | 10k+ | | | Output is not escaped |
| #69 | Pay with Vipps and MobilePay for WooCommerce | 25 | 851 | 519 | 5k+ | | | Output is not escaped |
| #70 | WP Statistics – Simple, privacy-friendly Google Analytics alternative | 25 | 612 | 2,469 | 600k+ | | | Non-prefixed global variable |
| #71 | AfterShip Tracking – All-In-One WooCommerce Order Tracking (Free plan available) | 26 | 286 | 291 | 7k+ | | | Text Domain Mismatch |
| #72 | AI Content Writing Assistant | 26 | 1,069 | 516 | 700 | | | Text Domain Mismatch |
| #73 | FlagShip WooCommerce Shipping | 26 | 495 | 188 | 400 | | | Non Singular String Literal Domain |
| #74 | XL NMI Gateway for WooCommerce | 26 | 695 | 436 | 1k+ | | | Text Domain Mismatch |
| #75 | Faktur Pro for WooCommerce | 26 | 416 | 219 | 1k+ | | | Text Domain Mismatch |
| #76 | Gravity Forms + Stripe | 27 | 368 | 210 | 600 | | | Output is not escaped |
| #77 | PublishPress Permissions: Control User Access for Posts, Pages, Categories, Tags | 27 | 424 | 323 | 10k+ | | | Missing Translators Comment |
| #78 | Shipit | 27 | 371 | 209 | 400 | | | Text Domain Mismatch |
| #79 | Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin | 28 | 121 | 135 | 3k+ | | | Non-prefixed global variable |
| #80 | Ultimate FAQ Accordion Plugin | 28 | 386 | 227 | 30k+ | | | Unsafe printing function |
| #81 | Login Me Now – Passwordless, Magic Link, OTP & Social Login for WordPress | 29 | 86 | 233 | 500 | | | Nonce verification recommended |
| #82 | SamedayCourier Shipping | 29 | 336 | 269 | 4k+ | | | Non Singular String Literal Domain |
| #83 | Bitcoin Payments – Blockonomics | 30 | 206 | 214 | 2k+ | | | Output is not escaped |
| #84 | PiWeb Export Customers Users & Guest customer to CSV for WooCommerce | 30 | 173 | 75 | 1k+ | | | Text Domain Mismatch |
| #85 | Checkout with Cash App on WooCommerce | 30 | 122 | 308 | 2k+ | | | Non-prefixed global variable |
| #86 | Custom Post Types and Custom Fields creator – WCK | 30 | 1,299 | 137 | 10k+ | | | Text Domain Mismatch |
| #87 | remarketable | 30 | 281 | 93 | 600 | | | Output is not escaped |
| #88 | ActiveCampaign – The autonomous marketing platform | 31 | 235 | 98 | 40k+ | | | Output is not escaped |
| #89 | CashBill.pl – Płatności WooCommerce | 31 | 181 | 101 | 900 | | | Output is not escaped |
| #90 | Mailgun for WordPress | 31 | 144 | 75 | 80k+ | | | Unsafe printing function |
| #91 | Tooltips for WordPress | 31 | 312 | 252 | 5k+ | | | Output is not escaped |
| #92 | WP Visitor Statistics (Real Time Traffic) | 31 | 353 | 691 | 20k+ | | | Nonce verification recommended |
| #93 | TS Poll – Survey, Versus Poll, Image Poll, Video Poll | 32 | 570 | 171 | 3k+ | | | Text Domain Mismatch |
| #94 | HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce | 33 | 377 | 139 | 20k+ | | | Unsafe printing function |
| #95 | CSS JS Manager, Async JavaScript, Defer Render Blocking CSS | 34 | 76 | 106 | 1k+ | | | Input is not validated |
| #96 | Arconix Shortcodes | 35 | 122 | 73 | 4k+ | | | Output is not escaped |
| #97 | CrowdSec | 35 | 130 | 119 | 2k+ | | | Output is not escaped |
| #98 | TS Webfonts for さくらのレンタルサーバ | 35 | 183 | 100 | 30k+ | | | Missing Arg Domain |
| #99 | Books Gallery – Book Showcase, Library & Affiliate Plugin | 35 | 1,134 | 147 | 2k+ | | | Unsafe printing function |
| #100 | TypeSquare Webfonts for エックスサーバー | 35 | 183 | 98 | 100k+ | | | Missing Arg Domain |