| #251 | Restrict – membership, site, content and user access restrictions for WordPress | 25 | 539 | 1,401 | 2k+ | | | Non-prefixed global variable |
| #252 | Seers AI | Cookie Consent Banner – GDPR & CCPA Compliant Consent Management Platform | 25 | 1,446 | 421 | 1k+ | | | Output is not escaped |
| #253 | Simple Link Directory – AI Powered | 25 | 133 | 420 | 2k+ | | | Non-prefixed global variable |
| #254 | Affiliate Program Suite — SliceWP Affiliates | 25 | 1,291 | 2,089 | 10k+ | | | Output is not escaped |
| #255 | Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management | 25 | 367 | 923 | 10k+ | | | SQL query is not prepared |
| #256 | Smart phone field for Gravity Forms | 25 | 540 | 1,316 | 6k+ | | | Non-prefixed global variable |
| #257 | Stylish Cost Calculator – Quote Generator, Lead Gen & Price Estimator | 25 | 648 | 1,021 | 1k+ | | | Output is not escaped |
| #258 | SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent | 25 | 432 | 1,357 | 10k+ | | | Direct Query |
| #259 | TemplateSpare – 1000+ WordPress Starter Templates & Full Site Migration Tool | 1-Click Import/Export & No-Code Builder | 25 | 705 | 1,587 | 10k+ | | | Non-prefixed global variable |
| #260 | Timeline Express | 25 | 531 | 147 | 9k+ | | | Text Domain Mismatch |
| #261 | Social Media Share Buttons & Social Sharing Icons | 25 | 2,433 | 1,383 | 100k+ | | | Unsafe printing function |
| #262 | Social Share Icons & Social Share Buttons | 25 | 2,365 | 1,357 | 10k+ | | | Output is not escaped |
| #263 | VikAppointments Services Booking Calendar | 25 | 9,753 | 5,207 | 500 | | | Output is not escaped |
| #264 | VikBooking Hotel Booking Engine & PMS | 25 | 13,251 | 8,316 | 8k+ | | | Output is not escaped |
| #265 | VikRentCar Car Rental Management System | 25 | 5,537 | 5,048 | 4k+ | | | Non-prefixed global variable |
| #266 | VikRestaurants Table Reservations and Take-Away | 25 | 11,644 | 4,932 | 600 | | | Output is not escaped |
| #267 | XT Floating Cart for WooCommerce | 25 | 1,232 | 1,985 | 4k+ | | | Non-prefixed global variable |
| #268 | Product Table for WooCommerce | 25 | 183 | 896 | 5k+ | | | Non-prefixed global variable |
| #269 | WP 2FA – Two-factor authentication for WordPress | 25 | 283 | 716 | 100k+ | | | Non-prefixed global variable |
| #270 | WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards | 25 | 1,431 | 1,270 | 10k+ | | | Output is not escaped |
| #271 | WP Popups – WordPress Popup builder | 25 | 440 | 342 | 30k+ | | | Output is not escaped |
| #272 | SlimStat Analytics | 25 | 1,177 | 870 | 70k+ | | | Exception output is not escaped |
| #273 | Smush – Image Optimization, Compression, Lazy Load, WebP & CDN | 25 | 244 | 568 | 1m+ | | | Non-prefixed hook name |
| #274 | WPvivid Backup for MainWP | 25 | 818 | 1,794 | 10k+ | | | Missing nonce verification |
| #275 | WPvivid — Backup, Migration & Staging | 25 | 900 | 1,461 | 900k+ | | | Non-prefixed namespace |
| #276 | Backup, Restore and Migrate your sites with XCloner | 25 | 238 | 864 | 10k+ | | | Input is not sanitized |
| #277 | XT Quick View for WooCommerce | 25 | 1,062 | 1,798 | 400 | | | Non-prefixed global variable |
| #278 | AfterShip Tracking – All-In-One WooCommerce Order Tracking (Free plan available) | 26 | 286 | 291 | 7k+ | | | Text Domain Mismatch |
| #279 | Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty | 26 | 113 | 671 | 400k+ | | | Non-prefixed global variable |
| #280 | GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites | 26 | 286 | 216 | 500 | | | badly named files |
| #281 | Omise Payments | 26 | 358 | 256 | 2k+ | | | Output is not escaped |
| #282 | Crowdsignal Dashboard – Polls, Surveys & more | 26 | 481 | 491 | 200k+ | | | Unsafe printing function |
| #283 | Video Gallery – Vimeo and YouTube Gallery | 26 | 561 | 794 | 6k+ | | | Non-prefixed global variable |
| #284 | Tag Groups is the Advanced Way to Display Your Taxonomy Terms | 26 | 351 | 232 | 3k+ | | | Unsafe printing function |
| #285 | User Submitted Posts – Enable Users to Submit Posts from the Front End | 26 | 699 | 396 | 10k+ | | | Text Domain Mismatch |
| #286 | Virtue/Ascend/Pinnacle Toolkit | 26 | 605 | 300 | 30k+ | | | Output is not escaped |
| #287 | HireZoot – Job Listings, Career Page & Recruitment Tool | 26 | 80 | 620 | 40k+ | | | Non-prefixed global variable |
| #288 | Accordions – Responsive Accordion & FAQ Plugin for WordPress | 27 | 554 | 158 | 1k+ | | | Text Domain Mismatch |
| #289 | Amazon Product in a Post Plugin | 27 | 362 | 416 | 800 | | | Output is not escaped |
| #290 | Arconix FAQ | 27 | 552 | 201 | 6k+ | | | Text Domain Mismatch |
| #291 | Comment Link Remove and Other Comment Tools | 27 | 691 | 132 | 7k+ | | | Text Domain Mismatch |
| #292 | CM Tooltip Glossary | 27 | 611 | 188 | 7k+ | | | Output is not escaped |
| #293 | Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin | 27 | 212 | 497 | 2k+ | | | Non-prefixed global variable |
| #294 | iQ Block Country | 27 | 164 | 245 | 20k+ | | | Request data is not unslashed |
| #295 | My Private Site – Make Your Whole Site Private, Force Login & Block Registration Spam | 27 | 713 | 321 | 10k+ | | | Text Domain Mismatch |
| #296 | Loco Translate | 27 | 451 | 225 | 1m+ | | | Output is not escaped |
| #297 | Online Booking & Scheduling Calendar for WordPress by vcita | 27 | 473 | 161 | 1k+ | | | Output is not escaped |
| #298 | Quick Paypal Payments | 27 | 101 | 303 | 1k+ | | | Non-prefixed function |
| #299 | Restrict for Elementor | 27 | 530 | 1,223 | 900 | | | Non-prefixed global variable |
| #300 | Shipit | 27 | 371 | 209 | 400 | | | Text Domain Mismatch |