| #101 | Login Security Solution | 27 | 216 | 154 | 4k+ | | | Output is not escaped |
| #102 | PublishPress Permissions: Control User Access for Posts, Pages, Categories, Tags | 27 | 424 | 323 | 10k+ | | | Missing Translators Comment |
| #103 | Tutor LMS – Migration Tool | 27 | 139 | 341 | 1k+ | | | Direct Query |
| #104 | Ultimate Watermark – Image Watermark, Image Protection & Bulk Watermarking | 27 | 164 | 303 | 1k+ | | | Nonce verification recommended |
| #105 | WP Events Manager | 27 | 172 | 369 | 30k+ | | | Non-prefixed hook name |
| #106 | Darklup – Enhanced WordPress Dark Mode, Dark Theme, Night Mode & Accessibility Plugin | 28 | 639 | 85 | 1k+ | | | Text Domain Mismatch |
| #107 | Redis Object Cache | 28 | 151 | 103 | 400k+ | | | Exception output is not escaped |
| #108 | Terms descriptions | 28 | 222 | 423 | 1k+ | | | Non-prefixed function |
| #109 | Connect Matomo – Analytics Dashboard for WordPress | 28 | 100 | 111 | 60k+ | | | Nonce verification recommended |
| #110 | Branded Social Images – Open Graph Images with logo and extra text layer | 29 | 254 | 91 | 900 | | | Non Singular String Literal Domain |
| #111 | Product Carousel Slider & Grid Ultimate for WooCommerce | 29 | 719 | 122 | 6k+ | | | Text Domain Mismatch |
| #112 | Cryptocurrency Donation Box – Bitcoin & Crypto Donations | 30 | 334 | 284 | 500 | | | Output is not escaped |
| #113 | Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget | 30 | 231 | 102 | 900 | | | Non Singular String Literal Domain |
| #114 | AI Builder – Generate pages, blocks, images & translate with AI | 31 | 101 | 194 | 500 | | | Non-prefixed global variable |
| #115 | Thanh Toán Quét Mã QR Code Tự Động – MoMo, ViettelPay, VNPay và 40 ngân hàng Việt Nam | 31 | 598 | 70 | 600 | | | Text Domain Mismatch |
| #116 | CleverReach® WP | 31 | 103 | 93 | 4k+ | | | Non-prefixed global variable |
| #117 | Export Order Items for WooCommerce | 31 | 100 | 108 | 1k+ | | | Text Domain Mismatch |
| #118 | OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. | 31 | 213 | 63 | 300k+ | | | Output is not escaped |
| #119 | Mailgun for WordPress | 31 | 144 | 75 | 80k+ | | | Unsafe printing function |
| #120 | Mailrelay | 31 | 317 | 170 | 1k+ | | | Text Domain Mismatch |
| #121 | reCAPTCHA in WP comments form | 31 | 264 | 60 | 8k+ | | | Output is not escaped |
| #122 | WPGatsby | 31 | 125 | 55 | 3k+ | | | Text Domain Mismatch |
| #123 | Quantity Discounts, Breaks & Product Bundles for Woocommerce By Bundler | 32 | 147 | 319 | 400 | | | Direct Query |
| #124 | Enter Addons – Ultimate Template Builder for Elementor | 32 | 82 | 72 | 1k+ | | | Output is not escaped |
| #125 | MetaSlider Gallery – Image Gallery, Lightbox Galleries, Modal Windows | 32 | 166 | 70 | 10k+ | | | Output is not escaped |
| #126 | WP Mobile Menu – The Mobile-Friendly Responsive Menu | 32 | 990 | 195 | 70k+ | | | Output is not escaped |
| #127 | Mollie Payments for WooCommerce | 32 | 71 | 134 | 100k+ | | | Dynamic hook name |
| #128 | Posti Shipping | 32 | 664 | 157 | 1k+ | | | Text Domain Mismatch |
| #129 | User Registration Using Contact Form 7 | 32 | 103 | 15 | 500 | | | wp function not compatible with requires wp |
| #130 | App Builder – Create Native Android & iOS Apps On The Flight | 33 | 73 | 119 | 600 | | | Text Domain Mismatch |
| #131 | Fastly | 33 | 221 | 66 | 1k+ | | | Text Domain Mismatch |
| #132 | Comments – GraphComment | AI-Moderated Comment System | 33 | 196 | 177 | 400 | | | Unsafe printing function |
| #133 | jQuery Manager for WordPress | 33 | 86 | 24 | 7k+ | | | Output is not escaped |
| #134 | Logo Showcase Ultimate – Logo Carousel, Logo Slider & Logo Grid | 33 | 274 | 106 | 3k+ | | | Text Domain Mismatch |
| #135 | GDPR CCPA Compliance & Cookie Consent Banner | 33 | 622 | 87 | 1k+ | | | Non Singular String Literal Domain |
| #136 | PostNL for WooCommerce | 33 | 598 | 104 | 3k+ | | | Text Domain Mismatch |
| #137 | affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display | 34 | 325 | 76 | 2k+ | | | Output is not escaped |
| #138 | JS Archive List | 34 | 99 | 31 | 3k+ | | | Output is not escaped |
| #139 | Swiftype Site Search Plugin for WordPress | 34 | 250 | 50 | 400 | | | Output is not escaped |
| #140 | ACF Content Analysis for Yoast SEO | 35 | 9 | 17 | 100k+ | | | Non-prefixed constant |
| #141 | AdPlugg WordPress Ad Plugin | 35 | 58 | 17 | 500 | | | Missing direct file access protection |
| #142 | AnsPress – Question and answer | 35 | 22 | 778 | 3k+ | | | Non-prefixed function |
| #143 | Archive Content with Archived Post Status | 35 | 3 | 2 | 5k+ | | | Discouraged text-domain loading |
| #144 | bbPress Notify (No-Spam) | 35 | 62 | 66 | 2k+ | | | wp function not compatible with requires wp |
| #145 | Gutenberg Block Editor Toolkit – EditorsKit | 35 | 61 | 25 | 20k+ | | | Text Domain Mismatch |
| #146 | BugHerd | 35 | 8 | 2 | 3k+ | | | Output is not escaped |
| #147 | CF7 Spreadsheets | 35 | 100 | 62 | 400 | | | Text Domain Mismatch |
| #148 | Kit (formerly ConvertKit) for WooCommerce | 35 | 213 | 18 | 4k+ | | | Text Domain Mismatch |
| #149 | Custom 404 Pro | 35 | 50 | 27 | 7k+ | | | wp function not compatible with requires wp |
| #150 | Custom Post Type Permalinks | 35 | 8 | 4 | 200k+ | | | Setting is missing a sanitization callback |