| #1 | 404 Solution | 15 | 582 | 1,532 | 10k+ | | | Non-prefixed class |
| #2 | WPPizza – A Restaurant Plugin | 18 | 4,689 | 2,703 | 1k+ | | | Text Domain Mismatch |
| #3 | Microthemer Lite – Visual Editor to Customize CSS | 20 | 1,004 | 1,699 | 10k+ | | | Non-prefixed global variable |
| #4 | Events Manager – OpenStreetMaps | 20 | 559 | 444 | 600 | | | Output is not escaped |
| #5 | Forumax – AI Powered Advanced Community Forum Plugin | 21 | 4,931 | 4,352 | 600 | | | Text Domain Mismatch |
| #6 | Kadence Security – Password, Two Factor Authentication, and Brute Force Protection | 21 | 1,060 | 959 | 700k+ | | | Missing Translators Comment |
| #7 | Event Espresso – Event Registration & Ticketing Sales | 21 | 12,710 | 2,136 | 600 | | | Text Domain Mismatch |
| #8 | Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included | 21 | 1,081 | 3,147 | 40k+ | | | Direct Query |
| #9 | Events Manager – Calendar, Bookings, Tickets, and more! | 22 | 4,712 | 5,690 | 60k+ | | | Output is not escaped |
| #10 | If-So Dynamic Content – Elementor & All Page Builders Personalization | 22 | 969 | 844 | 7k+ | | | Output is not escaped |
| #11 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses | 22 | 2,371 | 3,617 | 70k+ | | | Non-prefixed global variable |
| #12 | Mailchimp for WooCommerce | 22 | 524 | 658 | 200k+ | | | Non-prefixed global variable |
| #13 | MotoPress Hotel Booking | 22 | 3,067 | 1,050 | 10k+ | | | Text Domain Mismatch |
| #14 | oik | 22 | 487 | 180 | 2k+ | | | Non Singular String Literal Domain |
| #15 | Slim Jetpack | 22 | 2,586 | 1,947 | 2k+ | | | Text Domain Mismatch |
| #16 | All In One Login — Login Page Security and Customization for WordPress with Google reCAPTCHA, Social Login, Temporary Login, 2FA, and more. | 23 | 645 | 1,415 | 60k+ | | | Non-prefixed global variable |
| #17 | FV Flowplayer Video Player | 23 | 1,280 | 1,456 | 10k+ | | | Output is not escaped |
| #18 | Listdom: AI-powered Business Directory with Classifieds Ads Listings | 23 | 4,976 | 3,962 | 1k+ | | | Output is not escaped |
| #19 | The Events Calendar | 23 | 3,519 | 3,851 | 600k+ | | | Text Domain Mismatch |
| #20 | Travelpayouts | 23 | 761 | 114 | 6k+ | | | Output is not escaped |
| #21 | ManageWP Worker | 23 | 501 | 570 | 1m+ | | | Non-prefixed class |
| #22 | WebTotem Security | 23 | 1,091 | 213 | 800 | | | Text Domain Mismatch |
| #23 | FV Player 8 | 24 | 330 | 1,372 | 1k+ | | | Non-prefixed function |
| #24 | Photo Gallery – Responsive Image Galleries by Supsystic | 24 | 247 | 82 | 20k+ | | | Text Domain Mismatch |
| #25 | SiteOrigin Widgets Bundle | 24 | 605 | 455 | 400k+ | | | Output is not escaped |
| #26 | WPML Multilingual & Multicurrency for WooCommerce | 24 | 1,599 | 1,691 | 100k+ | | | SQL query is not prepared |
| #27 | xili-language | 24 | 1,501 | 523 | 600 | | | Output is not escaped |
| #28 | Online Scheduling and Appointment Booking System – Bookly | 25 | 1,166 | 933 | 60k+ | | | SQL query is not prepared |
| #29 | DecaLog | 25 | 943 | 236 | 1k+ | | | Exception output is not escaped |
| #30 | Bus Ticket Booking with Seat Reservation | 26 | 211 | 398 | 800 | | | Non-prefixed global variable |
| #31 | PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes | 26 | 412 | 481 | 10k+ | | | Missing Translators Comment |
| #32 | CheckView – Form & Checkout Testing | 27 | 75 | 365 | 1k+ | | | Direct Query |
| #33 | PublishPress Permissions: Access Control, Content Permissions, User Access | 27 | 430 | 324 | 10k+ | | | Missing Translators Comment |
| #34 | WP Hide & Security Enhancer | 27 | 130 | 441 | 50k+ | | | Missing nonce verification |
| #35 | Eway Payment Gateway | 30 | 509 | 92 | 800 | | | Missing Translators Comment |
| #36 | Lana Sitemap | 33 | 241 | 217 | 400 | | | Non-prefixed global variable |
| #37 | Save as PDF Plugin by PDFCrowd | 33 | 301 | 257 | 1k+ | | | Non-prefixed global variable |
| #38 | HivePress – Business Directory, Listings & Classified Ads Plugin | 34 | 43 | 187 | 10k+ | | | Direct Query |
| #39 | PW WooCommerce Gift Cards | 34 | 236 | 188 | 20k+ | | | Output is not escaped |
| #40 | Authors Widget | 35 | 170 | 19 | 1k+ | | | Output is not escaped |
| #41 | Booking Calendar | 35 | 85 | 340 | 40k+ | | | Mixed line endings |
| #42 | WP GIF Uploader – Animated GIF Upload and Thumbnails | 36 | 129 | 43 | 1k+ | | | Text Domain Mismatch |
| #43 | The Events Calendar Shortcode & Block | 36 | 70 | 127 | 10k+ | | | Non-prefixed hook name |
| #44 | Direct Checkout – Quick View – Buy Now For WooCommerce | 37 | 96 | 113 | 2k+ | | | Missing nonce verification |
| #45 | Simple Countdown Timer – Sales, Launch and Event Countdowns | 37 | 116 | 114 | 1k+ | | | Missing Arg Domain |
| #46 | Product Badge, Label, Countdown Timer for WooCommerce – Sale Booster | 38 | 37 | 97 | 5k+ | | | Interpolated SQL is not prepared |
| #47 | Sentry for WordPress | 41 | 79 | 40 | 10k+ | | | Text Domain Mismatch |
| #48 | Log Emails | 47 | 19 | 29 | 6k+ | | | Non-prefixed global variable |
| #49 | Product Categories/Tags Bottom Description for WooCommerce | 47 | 60 | 23 | 3k+ | | | Text Domain Mismatch |
| #50 | XML Sitemap & Google News | 47 | 270 | 224 | 100k+ | | | Non-prefixed global variable |