| #1 | Microthemer Lite – Visual Editor to Customize CSS | 20 | 1,004 | 1,699 | 10k+ | | | Non-prefixed global variable |
| #2 | Eupago Gateway For Woocommerce | 21 | 576 | 233 | 2k+ | | | Output is not escaped |
| #3 | Filter Everything — WordPress & WooCommerce Filters | 21 | 634 | 943 | 50k+ | | | Non-prefixed global variable |
| #4 | Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred | 21 | 1,436 | 3,345 | 10k+ | | | Non-prefixed global variable |
| #5 | Five Star Restaurant Reservations – WordPress Booking Plugin | 21 | 1,101 | 1,159 | 10k+ | | | Output is not escaped |
| #6 | URL Shortify – Simple and Easy URL Shortener | 21 | 1,509 | 2,737 | 10k+ | | | Non-prefixed global variable |
| #7 | Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer | 22 | 2,854 | 1,269 | 40k+ | | | Text Domain Mismatch |
| #8 | Five Star Restaurant Menu and Food Ordering | 22 | 754 | 610 | 5k+ | | | Output is not escaped |
| #9 | GeoDirectory – WP Business Directory Plugin and Classified Listings Directory | 22 | 4,445 | 3,943 | 10k+ | | | Output is not escaped |
| #10 | Csomagpontok és Címkék WooCommerce-hez | 22 | 2,006 | 769 | 7k+ | | | Text Domain Mismatch |
| #11 | NinjaScanner – Virus & Malware scan | 22 | 596 | 551 | 30k+ | | | Non-prefixed global variable |
| #12 | PagBank / PagSeguro Connect para WooCommerce | 22 | 510 | 759 | 3k+ | | | Non-prefixed global variable |
| #13 | Slim Jetpack | 22 | 2,586 | 1,947 | 2k+ | | | Text Domain Mismatch |
| #14 | Customize Feeds for Twitter | 22 | 92 | 171 | 4k+ | | | Non-prefixed global variable |
| #15 | Easy Appointment Booking & Scheduling System – Webba Booking Calendar | 22 | 1,666 | 3,471 | 2k+ | | | Non-prefixed global variable |
| #16 | WPSSO Core – Complete Schema Markup and Meta Tags | 22 | 1,426 | 416 | 4k+ | | | Missing Translators Comment |
| #17 | The GDPR Framework By Data443 | 23 | 1,278 | 498 | 10k+ | | | Short PHP open tag found |
| #18 | Payment forms, Buy now buttons, and Invoicing System | GetPaid | 23 | 392 | 1,268 | 5k+ | | | Non-prefixed global variable |
| #19 | ND Shortcodes | 23 | 621 | 2,426 | 20k+ | | | Non-prefixed global variable |
| #20 | The Events Calendar | 23 | 3,478 | 3,846 | 600k+ | | | Text Domain Mismatch |
| #21 | WP Migrate Lite – Migration Made Easy | 23 | 371 | 257 | 200k+ | | | Exception output is not escaped |
| #22 | Xpro Addons For Beaver Builder – Lite | 23 | 3,454 | 640 | 700 | | | Text Domain Mismatch |
| #23 | Borderless – Addons and Templates for Elementor | 24 | 437 | 1,387 | 5k+ | | | Non-prefixed global variable |
| #24 | Builderall for WordPress | 24 | 4,778 | 1,307 | 1k+ | | | Text Domain Mismatch |
| #25 | Church Admin | 24 | 1,556 | 4,200 | 900 | | | Direct Query |
| #26 | Disable Bloat for WordPress & WooCommerce | 24 | 828 | 1,317 | 10k+ | | | Non-prefixed global variable |
| #27 | Event Tickets and Registration | 24 | 3,368 | 4,206 | 90k+ | | | Non-prefixed global variable |
| #28 | Food Store – Online Food Delivery & Pickup | 24 | 824 | 1,917 | 1k+ | | | Non-prefixed global variable |
| #29 | MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar | 24 | 4,060 | 486 | 20k+ | | | Text Domain Mismatch |
| #30 | Musician's Pack for Elementor – Music Website Widgets & Templates | 24 | 1,835 | 243 | 400 | | | Text Domain Mismatch |
| #31 | Podlove Podcast Publisher | 24 | 2,107 | 1,399 | 3k+ | | | Output is not escaped |
| #32 | Premium Blocks – Gutenberg Blocks, Patterns & Templates | 24 | 140 | 308 | 2k+ | | | Non-prefixed function |
| #33 | reGenerate Thumbnails Advanced | 24 | 220 | 122 | 60k+ | | | Unsafe printing function |
| #34 | Related Posts Thumbnails Plugin for WordPress | 24 | 314 | 413 | 20k+ | | | Non-prefixed function |
| #35 | Simple Membership | 24 | 2,315 | 1,746 | 40k+ | | | Unsafe printing function |
| #36 | Ultimate Addons for Beaver Builder – Lite | 24 | 2,751 | 486 | 20k+ | | | Text Domain Mismatch |
| #37 | WCMultiShipping — Mondial Relay, Inpost & Chronopost for WooCommerce | 24 | 733 | 499 | 5k+ | | | Output is not escaped |
| #38 | Payment Plugins Braintree For WooCommerce | 24 | 731 | 755 | 2k+ | | | Output is not escaped |
| #39 | pensopay Payments | 24 | 396 | 246 | 1k+ | | | Output is not escaped |
| #40 | NextMove Lite – Thank You Page for WooCommerce | 24 | 916 | 857 | 10k+ | | | Non-prefixed global variable |
| #41 | WP Travel Engine – Elementor Widgets | Create Travel Booking Website Using WordPress and Elementor | 24 | 6,052 | 2,237 | 10k+ | | | Text Domain Mismatch |
| #42 | xili-language | 24 | 1,501 | 523 | 600 | | | Output is not escaped |
| #43 | BuddyPress Docs | 25 | 284 | 421 | 6k+ | | | Nonce verification recommended |
| #44 | Smash Balloon Social Post Feed – Simple Social Feeds for WordPress | 25 | 534 | 994 | 200k+ | | | Output is not escaped |
| #45 | Gallery Images Ape | 25 | 588 | 341 | 1k+ | | | Output is not escaped |
| #46 | Kadence Central – Site Management, Backups, Security, and Reporting | 25 | 451 | 214 | 30k+ | | | Text Domain Mismatch |
| #47 | Music Player for Elementor – Audio Player & Podcast Player | 25 | 641 | 1,455 | 10k+ | | | Non-prefixed global variable |
| #48 | MyFatoorah – WooCommerce | 25 | 191 | 89 | 2k+ | | | Output is not escaped |
| #49 | Quick Event Manager | 25 | 151 | 388 | 1k+ | | | Non-prefixed function |
| #50 | VikBooking Hotel Booking Engine & PMS | 25 | 13,264 | 8,323 | 8k+ | | | Output is not escaped |