| #551 | PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus | 25 | 362 | 1,586 | 100k+ | | | Non-prefixed global variable |
| #552 | SilentShield – Captcha & Anti-Spam for WordPress (CF7, WPForms, Elementor, WooCommerce) | 25 | 235 | 214 | 10k+ | | | Database parameter is not escaped |
| #553 | CheckView – Form & Checkout Testing | 25 | 66 | 337 | 1k+ | | | Direct Query |
| #554 | Admin Columns | 25 | 613 | 995 | 100k+ | | | Non-prefixed namespace |
| #555 | Colissimo shipping methods for WooCommerce | 25 | 1,755 | 557 | 10k+ | | | Text Domain Mismatch |
| #556 | Disable Comments & Delete All Comments | 25 | 503 | 185 | 9k+ | | | Output is not escaped |
| #557 | Conditional Payment Methods for WooCommerce | 25 | 548 | 1,398 | 1k+ | | | Non-prefixed global variable |
| #558 | Contact Form Email | 25 | 409 | 898 | 9k+ | | | Non-prefixed global variable |
| #559 | Coupon Creator | 25 | 698 | 412 | 1k+ | | | Output is not escaped |
| #560 | CP Contact Form with PayPal | 25 | 466 | 936 | 800 | | | Unsafe printing function |
| #561 | Cryptocurrency Payment Gateway | 25 | 1,963 | 589 | 400 | | | Text Domain Mismatch |
| #562 | Smash Balloon Social Post Feed – Simple Social Feeds for WordPress | 25 | 554 | 982 | 200k+ | | | Output is not escaped |
| #563 | DecaLog | 25 | 943 | 236 | 1k+ | | | Exception output is not escaped |
| #564 | Docket Cache – Object Cache Accelerator | 25 | 333 | 481 | 20k+ | | | Output is not escaped |
| #565 | ELEX WooCommerce Dynamic Pricing and Discounts | 25 | 478 | 748 | 800 | | | Text Domain Mismatch |
| #566 | 胖鼠采集(Fat Rat Collect) | 25 | 630 | 190 | 900 | | | Missing Arg Domain |
| #567 | FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler | 25 | 319 | 454 | 7k+ | | | Non-prefixed global variable |
| #568 | Fluid Checkout for WooCommerce – Lite | 25 | 370 | 841 | 20k+ | | | Non-prefixed hook name |
| #569 | Photo Gallery by FooGallery : Responsive Image Gallery, Masonry Gallery & Carousel | 25 | 876 | 1,798 | 100k+ | | | Non-prefixed global variable |
| #570 | WP Fast Total Search – The Power of Indexed Search | 25 | 209 | 291 | 1k+ | | | Non-prefixed global variable |
| #571 | FunnelKit – Funnel Builder for WooCommerce Checkout | 25 | 3,164 | 2,624 | 30k+ | | | Text Domain Mismatch |
| #572 | Photo Gallery by Ays – Responsive Image Gallery | 25 | 466 | 820 | 1k+ | | | Output is not escaped |
| #573 | GD Rating System | 25 | 1,511 | 1,043 | 1k+ | | | Output is not escaped |
| #574 | GeekyBot — AI Copilot, Chatbot, WooCommerce Lead Gen & Zero-Prompt Content | 25 | 88 | 863 | 6k+ | | | Non-prefixed global variable |
| #575 | Genesis Club Lite | 25 | 513 | 317 | 900 | | | Output is not escaped |
| #576 | WPBruiser {no- Captcha anti-Spam} | 25 | 646 | 259 | 10k+ | | | Non Singular String Literal Domain |
| #577 | Logo Slider – Logo Showcase, Logo Carousel, Logo Gallery and Client Logo Presentation | 25 | 789 | 313 | 30k+ | | | Text Domain Mismatch |
| #578 | Hardcore Google Fonts Localizer | 25 | 331 | 261 | 900 | | | Text Domain Mismatch |
| #579 | HashBar – Announcement, Notification Bar & Popup Campaign | 25 | 2,718 | 610 | 8k+ | | | Text Domain Mismatch |
| #580 | Cool Author Box – For Widget and Post Content | 25 | 853 | 1,379 | 600 | | | Non-prefixed global variable |
| #581 | HT Contact Form – Drag & Drop Form Builder for WordPress | 25 | 160 | 594 | 10k+ | | | Non-prefixed global variable |
| #582 | Hydra Booking — Appointment Scheduling & Booking Calendar | 25 | 235 | 699 | 2k+ | | | Non-prefixed global variable |
| #583 | Independent Analytics – WordPress Analytics Plugin | 25 | 1,148 | 2,293 | 100k+ | | | Non-prefixed global variable |
| #584 | Index WP MySQL For Speed | 25 | 250 | 255 | 50k+ | | | Output is not escaped |
| #585 | Smash Balloon Social Photo Feed – Easy Social Feeds Plugin | 25 | 449 | 1,300 | 1m+ | | | Interpolated SQL is not prepared |
| #586 | Instantio — Side Cart & One-Page Checkout for WooCommerce | 25 | 568 | 369 | 700 | | | Output is not escaped |
| #587 | IP Location Block | 25 | 521 | 624 | 10k+ | | | Output is not escaped |
| #588 | JobWP – Job Board, Job Listing, Career Page and Recruitment Plugin | 25 | 1,541 | 1,578 | 1k+ | | | Non-prefixed global variable |
| #589 | JoomSport – for Sports: Team & League, Football, Hockey & more | 25 | 523 | 1,747 | 1k+ | | | Direct Query |
| #590 | Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more | 25 | 4,019 | 1,265 | 2k+ | | | Text Domain Mismatch |
| #591 | Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force Prevention | 25 | 617 | 614 | 1m+ | | | Unsafe printing function |
| #592 | Live Composer – Free WordPress Website Builder | 25 | 1,216 | 427 | 10k+ | | | Output is not escaped |
| #593 | Loginizer | 25 | 814 | 504 | 1m+ | | | Output is not escaped |
| #594 | MaxButtons – Create buttons | 25 | 626 | 404 | 70k+ | | | Output is not escaped |
| #595 | Media Cleaner: Clean your WordPress! | 25 | 151 | 391 | 90k+ | | | Direct Query |
| #596 | Minimum and Maximum Quantity for WooCommerce | 25 | 556 | 1,436 | 3k+ | | | Non-prefixed global variable |
| #597 | Multibanco / MB Way / Payshop / Cofidis Pay (by LUSOPAY) for WooCommerce | 25 | 492 | 216 | 400 | | | Text Domain Mismatch |
| #598 | MyFatoorah – WooCommerce | 25 | 191 | 89 | 2k+ | | | Output is not escaped |
| #599 | All-in-one Sticky Floating Contact Form, Call, Click to Chat, and 50+ Social Icon Tabs – My Sticky Elements | 25 | 352 | 597 | 40k+ | | | Non-prefixed global variable |
| #600 | Nexter Extension – Security, Performance, Code Snippets & Site Toolkit | 25 | 198 | 712 | 10k+ | | | Nonce verification recommended |