| #51 | Easy Appointment Booking & Scheduling System – Webba Booking Calendar | 22 | 1,617 | 3,380 | 2k+ | | | Non-prefixed global variable |
| #52 | YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports | 22 | 654 | 435 | 10k+ | | | Exception output is not escaped |
| #53 | BuddyPress | 23 | 584 | 9,012 | 90k+ | | | Non-prefixed function |
| #54 | CallTrackingMetrics | 23 | 922 | 286 | 3k+ | | | Unsafe printing function |
| #55 | Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI | 23 | 395 | 1,343 | 90k+ | | | Non-prefixed global variable |
| #56 | FV Flowplayer Video Player | 23 | 1,311 | 1,454 | 10k+ | | | Output is not escaped |
| #57 | Payment forms, Buy now buttons, and Invoicing System | GetPaid | 23 | 390 | 1,266 | 5k+ | | | Non-prefixed global variable |
| #58 | InfiniteWP Client | 23 | 2,280 | 1,811 | 200k+ | | | Exception output is not escaped |
| #59 | Link Whisper Free | 23 | 3,926 | 5,402 | 30k+ | | | Text Domain Mismatch |
| #60 | Ocean Extra | 23 | 1,494 | 2,110 | 500k+ | | | Non-prefixed global variable |
| #61 | Post to Google My Business (Google Business Profile) | 23 | 845 | 1,452 | 10k+ | | | Non-prefixed global variable |
| #62 | Postie | 23 | 408 | 259 | 10k+ | | | Output is not escaped |
| #63 | UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP | 23 | 695 | 2,440 | 20k+ | | | Non-prefixed hook name |
| #64 | WP STAGING – WordPress Backups, Restore, Migration & Clone | 23 | 1,523 | 1,670 | 100k+ | | | Non-prefixed global variable |
| #65 | 404 Solution | 24 | 483 | 1,355 | 10k+ | | | Non-prefixed class |
| #66 | Advanced Contact form 7 DB | 24 | 765 | 1,961 | 70k+ | | | Non-prefixed global variable |
| #67 | TermsFeed AutoTerms: Privacy Policy Generator, Cookie Consent, GDPR, CCPA, Terms & Conditions, Disclaimers, Cookies Policy, EULA | 24 | 939 | 161 | 70k+ | | | Non Singular String Literal Domain |
| #68 | BuddyPress Group Email Subscription | 24 | 51 | 336 | 1k+ | | | Non-prefixed function |
| #69 | Message Filter for Contact Form 7 | 24 | 1,044 | 1,594 | 1k+ | | | Non-prefixed global variable |
| #70 | FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution | 24 | 203 | 797 | 80k+ | | | Direct Query |
| #71 | Connector Wizard (formerly LC Wizard) | 24 | 249 | 448 | 900 | | | Non-prefixed function |
| #72 | Mailjet Email Marketing | 24 | 435 | 206 | 10k+ | | | Unsafe printing function |
| #73 | MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings | 24 | 167 | 628 | 5k+ | | | Non-prefixed global variable |
| #74 | PayPal Brasil para WooCommerce | 24 | 683 | 356 | 1k+ | | | Unsafe printing function |
| #75 | Post Status Notifier Lite | 24 | 984 | 451 | 700 | | | Missing direct file access protection |
| #76 | Timber | 24 | 85 | 128 | 20k+ | | | Non-prefixed hook name |
| #77 | User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder | 24 | 667 | 3,385 | 50k+ | | | Non-prefixed global variable |
| #78 | weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot | 24 | 279 | 542 | 4k+ | | | Non-prefixed global variable |
| #79 | WP Discourse | 24 | 103 | 114 | 1k+ | | | Nonce verification recommended |
| #80 | XT Ajax Add To Cart for WooCommerce | 24 | 985 | 1,665 | 1k+ | | | Non-prefixed global variable |
| #81 | XT Variation Swatches for WooCommerce | 24 | 1,033 | 1,809 | 500 | | | Non-prefixed global variable |
| #82 | Coinbase Business Gateway for WooCommerce | 25 | 569 | 1,317 | 800 | | | Non-prefixed global variable |
| #83 | Gallery Images Ape | 25 | 588 | 341 | 1k+ | | | Output is not escaped |
| #84 | Instantio — Side Cart & One-Page Checkout for WooCommerce | 25 | 568 | 369 | 700 | | | Output is not escaped |
| #85 | Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more | 25 | 4,019 | 1,265 | 2k+ | | | Text Domain Mismatch |
| #86 | NOWPayments for WooCommerce – Crypto Payment Gateway | 25 | 534 | 1,306 | 4k+ | | | Non-prefixed global variable |
| #87 | Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker | 25 | 381 | 2,621 | 40k+ | | | Non-prefixed hook name |
| #88 | StoreGrowth – Upsell, BOGO, Quick View, Direct Checkout & Side Cart for WooCommerce | 25 | 127 | 441 | 2k+ | | | Non-prefixed global variable |
| #89 | Timeline Express | 25 | 531 | 147 | 9k+ | | | Text Domain Mismatch |
| #90 | VikAppointments Services Booking Calendar | 25 | 9,759 | 5,209 | 500 | | | Output is not escaped |
| #91 | VikRestaurants Table Reservations and Take-Away | 25 | 11,644 | 4,932 | 600 | | | Output is not escaped |
| #92 | weForms – Easy Drag & Drop Contact Form Builder For WordPress | 25 | 916 | 450 | 10k+ | | | Output is not escaped |
| #93 | XT Floating Cart for WooCommerce | 25 | 1,232 | 1,985 | 4k+ | | | Non-prefixed global variable |
| #94 | SlimStat Analytics | 25 | 1,177 | 870 | 70k+ | | | Exception output is not escaped |
| #95 | XT Quick View for WooCommerce | 25 | 1,062 | 1,798 | 400 | | | Non-prefixed global variable |
| #96 | FlagShip WooCommerce Shipping | 26 | 495 | 188 | 400 | | | Non Singular String Literal Domain |
| #97 | Integrate Razorpay for Contact Form 7 | 26 | 152 | 97 | 500 | | | curl curl setopt |
| #98 | Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content | 26 | 531 | 1,359 | 300k+ | | | Non-prefixed global variable |
| #99 | My Private Site – Make Your Whole Site Private, Force Login & Block Registration Spam | 27 | 714 | 322 | 10k+ | | | Text Domain Mismatch |
| #100 | Ray Enterprise Translation | 27 | 87 | 606 | 8k+ | | | Non-prefixed global variable |