| #1 | Themify Builder | 9 | 5,304 | 2,136 | 5k+ | | | Text Domain Mismatch |
| #2 | JetBackup – Backup, Restore & Migrate | 10 | 1,563 | 149 | 200k+ | | | Exception output is not escaped |
| #3 | Visual Composer Website Builder | 16 | 82 | 320 | 40k+ | | | Non-prefixed global variable |
| #4 | Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons | 19 | 10,340 | 360 | 100k+ | | | Text Domain Mismatch |
| #5 | Matomo Analytics – Powerful, Privacy-First Insights for WordPress | 19 | 1,900 | 877 | 100k+ | | | Exception output is not escaped |
| #6 | Brizy – Page Builder | 20 | 586 | 726 | 70k+ | | | Output is not escaped |
| #7 | Event Organiser | 20 | 1,104 | 544 | 20k+ | | | Text Domain Mismatch |
| #8 | Leaky Paywall | 20 | 322 | 789 | 600 | | | Nonce verification recommended |
| #9 | Forumax – AI Powered Advanced Community Forum Plugin | 21 | 4,936 | 4,353 | 600 | | | Text Domain Mismatch |
| #10 | Filter Everything — WordPress & WooCommerce Filters | 21 | 643 | 933 | 50k+ | | | Non-prefixed global variable |
| #11 | LA-Studio Element Kit for Elementor | 21 | 8,403 | 1,882 | 10k+ | | | Text Domain Mismatch |
| #12 | Quill Forms | Conversational Multi Step Forms, Surveys & quizzes | 21 | 401 | 369 | 3k+ | | | Text Domain Mismatch |
| #13 | Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin | 21 | 1,064 | 2,975 | 40k+ | | | Direct Query |
| #14 | Pay For Post with WooCommerce | 21 | 958 | 1,477 | 1k+ | | | Non-prefixed global variable |
| #15 | wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin | 21 | 1,812 | 1,432 | 70k+ | | | Output is not escaped |
| #16 | Ebook Store | 22 | 410 | 1,054 | 700 | | | Non-prefixed global variable |
| #17 | FunnelKit Payment Gateway for Stripe WooCommerce | 22 | 244 | 321 | 20k+ | | | Input is not sanitized |
| #18 | Happy Addons for Elementor | 22 | 652 | 446 | 400k+ | | | Output is not escaped |
| #19 | If-So Dynamic Content – Elementor & All Page Builders Personalization | 22 | 966 | 839 | 7k+ | | | Output is not escaped |
| #20 | The Innovative Form Builder – IvyForms | 22 | 750 | 309 | 800 | | | Exception output is not escaped |
| #21 | JCH Optimize | 22 | 1,145 | 136 | 4k+ | | | Output is not escaped |
| #22 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses | 22 | 2,433 | 3,594 | 70k+ | | | Non-prefixed global variable |
| #23 | MapSVG – Vector maps, Image maps, Google Maps | 22 | 179 | 93 | 1k+ | | | Missing direct file access protection |
| #24 | Newsletters | 22 | 2,976 | 2,257 | 2k+ | | | Text Domain Mismatch |
| #25 | PDF Builder for WPForms | 22 | 321 | 266 | 900 | | | SQL query is not prepared |
| #26 | WCFM – Frontend Manager for WooCommerce | 22 | 4,731 | 5,057 | 20k+ | | | Non-prefixed global variable |
| #27 | WCFM Marketplace – Multivendor Marketplace for WooCommerce | 22 | 1,950 | 2,108 | 10k+ | | | Non-prefixed global variable |
| #28 | Advanced AJAX Product Filters | 22 | 2,840 | 1,252 | 50k+ | | | Text Domain Mismatch |
| #29 | WPSSO Core – Complete Schema Markup and Meta Tags | 22 | 1,409 | 414 | 5k+ | | | Missing Translators Comment |
| #30 | ЮKassa для WooCommerce | 22 | 591 | 167 | 9k+ | | | Short PHP open tag found |
| #31 | Recipe Cards For Your Food Blog from Zip Recipes | 22 | 1,126 | 1,731 | 1k+ | | | Non-prefixed global variable |
| #32 | Frontend Admin by DynamiApps | 23 | 5,946 | 3,231 | 9k+ | | | Text Domain Mismatch |
| #33 | Admin and Site Enhancements (ASE) | 23 | 139 | 328 | 200k+ | | | Nonce verification recommended |
| #34 | Advanced Custom Fields (ACF®) | 23 | 2,472 | 1,239 | 2m+ | | | Text Domain Mismatch |
| #35 | CallTrackingMetrics | 23 | 922 | 286 | 3k+ | | | Unsafe printing function |
| #36 | Cart Notices for WooCommerce | 23 | 639 | 474 | 2k+ | | | Text Domain Mismatch |
| #37 | Products Suggestions for WooCommerce | 23 | 707 | 505 | 700 | | | Output is not escaped |
| #38 | Smart Grid-Layout Design for Contact Form 7 | 23 | 954 | 459 | 10k+ | | | Output is not escaped |
| #39 | Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe | 23 | 9,358 | 26,430 | 1k+ | | | Non-prefixed global variable |
| #40 | Free Theme Builder for Elementor – CRT Addons (Header, Footer, Archive, WooCommerce & 50+ Widgets) | 23 | 791 | 2,331 | 400 | | | Non-prefixed global variable |
| #41 | Currency Exchange for WooCommerce | 23 | 692 | 505 | 500 | | | Output is not escaped |
| #42 | Conversios – GA4, Google Ads & Meta Conversion Tracking with Product Feed for WooCommerce | 23 | 114 | 1,499 | 10k+ | | | Non-prefixed global variable |
| #43 | IMPress for IDX Broker | 23 | 1,089 | 636 | 7k+ | | | Text Domain Mismatch |
| #44 | InfiniteWP Client | 23 | 2,287 | 1,811 | 200k+ | | | Exception output is not escaped |
| #45 | Link Whisper Free | 23 | 3,926 | 5,402 | 30k+ | | | Text Domain Mismatch |
| #46 | MultiParcels Shipping For WooCommerce | 23 | 197 | 387 | 4k+ | | | Mixed line endings |
| #47 | NitroPack – Performance, Page Speed & Cache Plugin for Core Web Vitals, CDN & Image Optimization | 23 | 311 | 635 | 90k+ | | | Output is not escaped |
| #48 | User Menus – Nav Menu Visibility | 23 | 531 | 1,298 | 80k+ | | | Non-prefixed global variable |
| #49 | Product Table & List Builder For WooCommerce | 23 | 1,380 | 2,125 | 10k+ | | | Non-prefixed global variable |
| #50 | AgenWebsite Shipping – Plugin Ongkos Kirim & Generate Resi Otomatis Semua Kurir Indonesia | 23 | 1,299 | 1,107 | 500 | | | Text Domain Mismatch |