| #151 | FlatPM – Ad Manager, AdSense and Custom Code | 25 | 3,017 | 557 | 10k+ | | | Text Domain Mismatch |
| #152 | Genesis Club Lite | 25 | 513 | 317 | 900 | | | Output is not escaped |
| #153 | WPBruiser {no- Captcha anti-Spam} | 25 | 646 | 259 | 10k+ | | | Non Singular String Literal Domain |
| #154 | Instantio — Side Cart & One-Page Checkout for WooCommerce | 25 | 568 | 369 | 700 | | | Output is not escaped |
| #155 | IP Location Block | 25 | 521 | 624 | 10k+ | | | Output is not escaped |
| #156 | Kadence Central – Site Management, Backups, Security, and Reporting | 25 | 451 | 214 | 30k+ | | | Text Domain Mismatch |
| #157 | Media Cleaner: Clean your WordPress! | 25 | 267 | 568 | 90k+ | | | Direct Query |
| #158 | Open User Map – Interactive Leaflet Maps | 25 | 870 | 1,000 | 10k+ | | | Non-prefixed global variable |
| #159 | phpinfo() WP – Site Health, PHP Compatibility & Server Audit | 25 | 993 | 776 | 3k+ | | | Unsafe printing function |
| #160 | Spexo Addons for Elementor – Elementor Widgets, Mega Menu, Popup Builder, Template Kits and Starter Templates for Elementor | 25 | 9 | 982 | 5k+ | | | Non-prefixed global variable |
| #161 | BerqWP – All-In-One Optimization for Core Web Vitals, Cache, CDN, Images, CSS & JavaScript | 25 | 204 | 556 | 4k+ | | | Non-prefixed global variable |
| #162 | Sugar Calendar – Events Calendar, Event Tickets, and Events Management Platform | 25 | 331 | 789 | 10k+ | | | Nonce verification recommended |
| #163 | Social Media Share Buttons & Social Sharing Icons | 25 | 2,432 | 1,365 | 100k+ | | | Unsafe printing function |
| #164 | VikAppointments Services Booking Calendar | 25 | 9,759 | 5,209 | 500 | | | Output is not escaped |
| #165 | VikBooking Hotel Booking Engine & PMS | 25 | 13,251 | 8,316 | 8k+ | | | Output is not escaped |
| #166 | VikRestaurants Table Reservations and Take-Away | 25 | 11,644 | 4,932 | 600 | | | Output is not escaped |
| #167 | VK All in One Expansion Unit | 25 | 905 | 495 | 100k+ | | | Output is not escaped |
| #168 | weForms – Easy Drag & Drop Contact Form Builder For WordPress | 25 | 916 | 450 | 10k+ | | | Output is not escaped |
| #169 | Secure Gateway for Authorize.net and WooCommerce by Pledged Plugins | 25 | 907 | 1,418 | 10k+ | | | Non-prefixed global variable |
| #170 | Enhanced Ecommerce Google Analytics for WooCommerce | 25 | 909 | 1,506 | 2k+ | | | Non-prefixed global variable |
| #171 | Flat Rate Shipping Method for WooCommerce | 25 | 1,242 | 1,778 | 5k+ | | | Non-prefixed global variable |
| #172 | WFatture for WooCommerce Fattureincloud | 25 | 218 | 775 | 800 | | | Non-prefixed global variable |
| #173 | Wordfence Login Security | 25 | 248 | 418 | 60k+ | | | Output is not escaped |
| #174 | WP 2FA – Two-factor authentication for WordPress | 25 | 255 | 717 | 100k+ | | | Non-prefixed global variable |
| #175 | Perfect Images: Regenerate Thumbnails, Image Sizes, WebP & AVIF | 25 | 157 | 128 | 60k+ | | | Non-prefixed global variable |
| #176 | WP Statistics – Simple, privacy-friendly Google Analytics alternative | 25 | 612 | 2,469 | 600k+ | | | Non-prefixed global variable |
| #177 | WP Super Cache | 25 | 800 | 989 | 1m+ | | | Output is not escaped |
| #178 | Video Gallery – YouTube Gallery, Playlist & Video Grid | 25 | 275 | 1,066 | 2k+ | | | Non-prefixed hook name |
| #179 | WP Frontend Admin – Display WP Admin Pages in the Frontend | 26 | 347 | 337 | 400 | | | Non Singular String Literal Domain |
| #180 | Media File Renamer: Rename for better SEO (AI-Powered) | 26 | 154 | 164 | 40k+ | | | Direct Query |
| #181 | Paytium: Mollie payment forms & donations | 26 | 506 | 551 | 3k+ | | | Unsafe printing function |
| #182 | XL NMI Gateway for WooCommerce | 26 | 695 | 436 | 1k+ | | | Text Domain Mismatch |
| #183 | Comments Extra Fields For Post,Pages and CPT | 26 | 576 | 417 | 500 | | | Text Domain Mismatch |
| #184 | Church Content – Sermons, Events and More | 27 | 134 | 410 | 4k+ | | | Non-prefixed function |
| #185 | Database Cleaner | 27 | 140 | 294 | 10k+ | | | Direct Query |
| #186 | Gallery – Photo Albums Plugin | 27 | 647 | 252 | 2k+ | | | Output is not escaped |
| #187 | EasyParcel Shipping– All-in-one Shipping Solution, Real-Time Shipping Rates | 27 | 47 | 786 | 700 | | | Non-prefixed global variable |
| #188 | Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder | 27 | 308 | 293 | 700k+ | | | Text Domain Mismatch |
| #189 | Pie Register – User Registration, Profiles & Content Restriction | 27 | | 1,777 | 1k+ | | | Non-prefixed global variable |
| #190 | PublishPress Permissions: Control User Access for Posts, Pages, Categories, Tags | 27 | 424 | 323 | 10k+ | | | Missing Translators Comment |
| #191 | Tag, Category, and Taxonomy Manager – Autotagger Automatically Add Terms | 27 | 346 | 214 | 40k+ | | | Missing Translators Comment |
| #192 | Theme One Click Demo Importer | 27 | 210 | 157 | 400 | | | Text Domain Mismatch |
| #193 | Video Gallery for WooCommerce – Add Product Video & Featured Video | 27 | 117 | 478 | 4k+ | | | Non-prefixed global variable |
| #194 | Watu Quiz | 27 | 1,091 | 1,013 | 3k+ | | | Output is not escaped |
| #195 | Email Marketing Plugin – WP Email Capture | 27 | 383 | 262 | 1k+ | | | Output is not escaped |
| #196 | WP Events Manager | 27 | 172 | 369 | 30k+ | | | Non-prefixed hook name |
| #197 | Divi Torque Lite | 28 | 108 | 286 | 50k+ | | | Non-prefixed global variable |
| #198 | Code Engine – PHP Snippets, AI Functions & Automation for WordPress | 28 | 124 | 97 | 700 | | | Non Singular String Literal Domain |
| #199 | HootKit | 28 | 429 | 1,295 | 8k+ | | | Non-prefixed global variable |
| #200 | Media Hygiene: Remove or Delete Unused Images and More! | 28 | 654 | 309 | 5k+ | | | Non Singular String Literal Domain |