| #1 | Intercom | 0 | 60 | 71 | 6k+ | | | Non-prefixed function |
| #2 | 404 Solution | 15 | 582 | 1,532 | 10k+ | | | Non-prefixed class |
| #3 | RestroPress – Online Food Ordering System | 17 | 535 | 3,234 | 1k+ | | | Non-prefixed global variable |
| #4 | Efí Bank | 17 | 886 | 553 | 300 | | | Exception output is not escaped |
| #5 | Shopping Cart & eCommerce Store | 17 | 7,492 | 17,554 | 3k+ | | | Non-prefixed global variable |
| #6 | Administrator Z | 18 | 2,061 | 799 | 400 | | | Output is not escaped |
| #7 | Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution | 18 | 1,229 | 923 | 100k+ | | | Exception output is not escaped |
| #8 | Go Fetch Jobs (for WP Job Manager) | 19 | 1,410 | 1,741 | 600 | | | Non-prefixed global variable |
| #9 | SendPress Newsletters | 19 | 2,293 | 1,422 | 1k+ | | | Output is not escaped |
| #10 | WPOSS阿里云对象存储 | 19 | 269 | 315 | 900 | | | Non-prefixed namespace |
| #11 | WPQiNiu七牛云对象存储 | 19 | 138 | 612 | 400 | | | Non-prefixed global variable |
| #12 | AweBooking – Hotel Booking System | 20 | 309 | 514 | 1k+ | | | Non-prefixed global variable |
| #13 | SysBasics Customize My Account for WooCommerce – Live My Account Customizer | 20 | 743 | 911 | 8k+ | | | Non-prefixed global variable |
| #14 | MBE eShip | 20 | 527 | 740 | 1k+ | | | Non-prefixed global variable |
| #15 | Brevo – Email, SMS, Web Push, Chat, and more. | 20 | 460 | 646 | 100k+ | | | Request data is not unslashed |
| #16 | Quill Forms | Conversational Multi Step Forms, Surveys & quizzes | 20 | 400 | 371 | 3k+ | | | Text Domain Mismatch |
| #17 | Membership Plugin – Kadence Memberships | 20 | 5,089 | 3,005 | 9k+ | | | Text Domain Mismatch |
| #18 | School Management System – WPSchoolPress | 20 | 245 | 5,285 | 1k+ | | | Non-prefixed global variable |
| #19 | Kadence Security – Password, Two Factor Authentication, and Brute Force Protection | 21 | 1,060 | 959 | 700k+ | | | Missing Translators Comment |
| #20 | Mapster WP Maps | 21 | 3,594 | 3,020 | 3k+ | | | Text Domain Mismatch |
| #21 | Razorpay for Gravity Forms | 21 | 411 | 47 | 500 | | | Exception output is not escaped |
| #22 | Razorpay Quick Payments | 21 | 399 | 63 | 2k+ | | | Exception output is not escaped |
| #23 | Seamless Donations is Sunset | 21 | 600 | 514 | 2k+ | | | Text Domain Mismatch |
| #24 | SeatReg | 21 | 352 | 1,862 | 300 | | | Missing nonce verification |
| #25 | Smart Forms – when you need more than just a contact form | 21 | 776 | 574 | 5k+ | | | Output is not escaped |
| #26 | Accept Stripe Payments | 21 | 373 | 891 | 20k+ | | | Missing nonce verification |
| #27 | Buckaroo Payments for WooCommerce | 21 | 692 | 351 | 2k+ | | | Exception output is not escaped |
| #28 | Razorpay for WooCommerce | 21 | 980 | 864 | 100k+ | | | Non-prefixed function |
| #29 | WP Import Export Lite | 21 | 556 | 331 | 40k+ | | | Exception output is not escaped |
| #30 | WP-Lister Lite for eBay | 21 | 6,701 | 5,140 | 2k+ | | | Output is not escaped |
| #31 | wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin | 21 | 1,829 | 1,534 | 60k+ | | | Output is not escaped |
| #32 | WPScan – WordPress Security Scanner | 21 | 527 | 265 | 8k+ | | | Text Domain Mismatch |
| #33 | Events Manager – Calendar, Bookings, Tickets, Appointments and more! | 22 | 4,730 | 5,714 | 60k+ | | | Output is not escaped |
| #34 | Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI | 22 | 397 | 1,369 | 90k+ | | | Non-prefixed global variable |
| #35 | FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment | 22 | 153 | 847 | 7k+ | | | Non-prefixed global variable |
| #36 | GeoDirectory – WP Business Directory Plugin and Classified Listings Directory | 22 | 4,445 | 3,943 | 10k+ | | | Output is not escaped |
| #37 | Jim Soft Swiss QR Invoice | 22 | 269 | 392 | 400 | | | Non-prefixed global variable |
| #38 | MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. | 22 | 2,633 | 2,460 | 10k+ | | | Output is not escaped |
| #39 | Search Atlas SEO – OTTO AI SEO Automation for WordPress | 22 | 1,403 | 2,878 | 8k+ | | | Output is not escaped |
| #40 | Modula Image Gallery – Photo Grid & Video Gallery | 22 | 508 | 437 | 100k+ | | | Text Domain Mismatch |
| #41 | Packeta | 22 | 801 | 341 | 8k+ | | | Exception output is not escaped |
| #42 | PDF Builder for WPForms | 22 | 321 | 268 | 900 | | | SQL query is not prepared |
| #43 | Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App | 22 | 1,602 | 2,342 | 300k+ | | | Non-prefixed global variable |
| #44 | Salon Booking System – Appointment Booking for Salons, Barbershops & Spas | 22 | 209 | 802 | 2k+ | | | Non-prefixed global variable |
| #45 | SpeakOut! Email Petitions | 22 | 849 | 998 | 2k+ | | | Missing nonce verification |
| #46 | Customize Feeds for Twitter | 22 | 92 | 171 | 4k+ | | | Non-prefixed global variable |
| #47 | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin | 22 | 936 | 2,941 | 200k+ | | | Non-prefixed global variable |
| #48 | WCFM Membership – WooCommerce Memberships for Multivendor Marketplace | 22 | 551 | 642 | 10k+ | | | Non-prefixed global variable |
| #49 | Easy Appointment Booking & Scheduling System – Webba Booking Calendar | 22 | 1,666 | 3,471 | 2k+ | | | Non-prefixed global variable |
| #50 | Paysera Payment Gateway for WooCommerce | 22 | 1,870 | 198 | 7k+ | | | Exception output is not escaped |