| #901 | FV Antispam | 26 | 332 | 239 | 900 | | | Output is not escaped |
| #902 | Translate WordPress – Google Language Translator | 26 | 200 | 317 | 100k+ | | | Non-prefixed global variable |
| #903 | Ibtana – WordPress Website Builder | 26 | 173 | 409 | 10k+ | | | Non-prefixed global variable |
| #904 | Icegram Collect – Easy Form, Lead Collection and Subscription plugin | 26 | 423 | 292 | 2k+ | | | Output is not escaped |
| #905 | Integrate Razorpay for Contact Form 7 | 26 | 152 | 97 | 500 | | | curl curl setopt |
| #906 | Kadence Central – Site Management, Backups, Security, and Reporting | 26 | 462 | 213 | 30k+ | | | Text Domain Mismatch |
| #907 | JustTables – WooCommerce Product Table | 26 | 534 | 652 | 600 | | | Non-prefixed global variable |
| #908 | Kirki – Freeform Page Builder, Website Builder & Customizer | 26 | 191 | 803 | 500k+ | | | Nonce verification recommended |
| #909 | Klarna for WooCommerce | 26 | 284 | 507 | 30k+ | | | Dynamic hook name |
| #910 | MaxGalleria | 26 | 278 | 560 | 2k+ | | | Non-prefixed global variable |
| #911 | Media File Renamer: Rename for better SEO (AI-Powered) | 26 | 154 | 170 | 40k+ | | | Direct Query |
| #912 | Hotel Booking | 26 | 690 | 940 | 4k+ | | | Unsafe printing function |
| #913 | Omise Payments | 26 | 358 | 256 | 2k+ | | | Output is not escaped |
| #914 | Online Contact Widget-多合一在线客服插件 | 26 | 708 | 80 | 800 | | | Non Singular String Literal Domain |
| #915 | OOPSpam Anti-Spam: Spam Protection for WordPress Forms & Comments (No CAPTCHA) | 26 | 272 | 599 | 6k+ | | | Request data is not unslashed |
| #916 | Open User Map – Interactive Leaflet Maps | 26 | 895 | 988 | 10k+ | | | Non-prefixed global variable |
| #917 | Organic Builder Widgets – Simple WordPress Page Builder | 26 | 1,034 | 125 | 3k+ | | | Output is not escaped |
| #918 | Paytium: Mollie payment forms & donations | 26 | 506 | 551 | 3k+ | | | Unsafe printing function |
| #919 | LoginWP (Formerly Peter's Login Redirect) | 26 | 401 | 278 | 90k+ | | | Output is not escaped |
| #920 | Portfolio by BestWebSoft – Work and Projects Presentation Plugin for WordPress | 26 | 525 | 240 | 600 | | | Text Domain Mismatch |
| #921 | Profile Extra Fields by BestWebSoft | 26 | 514 | 532 | 2k+ | | | Text Domain Mismatch |
| #922 | RestaurantPress | 26 | 265 | 518 | 600 | | | Output is not escaped |
| #923 | Send Users Email – Email Subscribers, Email Marketing Newsletter | 26 | 188 | 415 | 5k+ | | | Non-prefixed global variable |
| #924 | SEO Booster | 26 | 403 | 1,331 | 1k+ | | | Non-prefixed global variable |
| #925 | SP Move Login | 26 | 881 | 215 | 6k+ | | | Text Domain Mismatch |
| #926 | Sliced Invoices – WordPress Invoice Plugin | 26 | 684 | 455 | 5k+ | | | Output is not escaped |
| #927 | StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart | 26 | 125 | 420 | 2k+ | | | Non-prefixed global variable |
| #928 | Subscriber by BestWebSoft | 26 | 550 | 376 | 900 | | | Text Domain Mismatch |
| #929 | SV Proven Expert | 26 | 747 | 380 | 900 | | | Output is not escaped |
| #930 | Tag Groups is the Advanced Way to Display Your Taxonomy Terms | 26 | 351 | 232 | 3k+ | | | Unsafe printing function |
| #931 | Theater for WordPress | 26 | 348 | 344 | 600 | | | Output is not escaped |
| #932 | Ultimate Reviews | 26 | 515 | 345 | 500 | | | Output is not escaped |
| #933 | UpdraftCentral Dashboard | 26 | 267 | 180 | 5k+ | | | Missing Translators Comment |
| #934 | URL Image Importer – Import External Images to the Media Library from URL, CSV & XML | 26 | 143 | 239 | 700 | | | Missing nonce verification |
| #935 | VikWidgetsLoader – Collection of Widgets | 26 | 1,182 | 538 | 1k+ | | | Output is not escaped |
| #936 | Virtue/Ascend/Pinnacle Toolkit | 26 | 605 | 300 | 30k+ | | | Output is not escaped |
| #937 | Visitors Online by BestWebSoft | 26 | 512 | 269 | 1k+ | | | Text Domain Mismatch |
| #938 | Cart Abandonment Recovery for WooCommerce – Recover Lost Sales with Automated Emails | 26 | 51 | 325 | 300k+ | | | Direct Query |
| #939 | Premmerce SEO for WooCommerce | 26 | 550 | 1,285 | 1k+ | | | Non-prefixed global variable |
| #940 | Set Price Note (Units, Offers, Editions) for WooCommerce | 26 | 596 | 1,307 | 800 | | | Non-prefixed global variable |
| #941 | Shipping Method Display Style for WooCommerce | 26 | 529 | 1,308 | 2k+ | | | Non-prefixed global variable |
| #942 | XL NMI Gateway for WooCommerce | 26 | 695 | 436 | 1k+ | | | Text Domain Mismatch |
| #943 | Faktur Pro for WooCommerce | 26 | 416 | 218 | 1k+ | | | Text Domain Mismatch |
| #944 | Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) | 26 | 2,652 | 2,093 | 10k+ | | | Text Domain Mismatch |
| #945 | WP Flashy Marketing Automation | 26 | 432 | 186 | 2k+ | | | Text Domain Mismatch |
| #946 | WPCOM Member | 26 | 432 | 638 | 1k+ | | | Non Singular String Literal Domain |
| #947 | WPFrank Companion | 26 | 2,356 | 865 | 1k+ | | | Text Domain Mismatch |
| #948 | Accordions – Responsive Accordion & FAQ Plugin for WordPress | 27 | 554 | 158 | 1k+ | | | Text Domain Mismatch |
| #949 | Addon Elements for Elementor (formerly Elementor Addon Elements) | 27 | 4,065 | 103 | 90k+ | | | Text Domain Mismatch |
| #950 | Divi Torque Lite – Divi Modules for the Divi Builder & Theme | 27 | 146 | 274 | 50k+ | | | Non-prefixed global variable |