| #101 | WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode | 25 | 1,250 | 1,929 | 10k+ | | | Non-prefixed global variable |
| #102 | Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) | 25 | 42 | 1,066 | 1k+ | | | Non-prefixed global variable |
| #103 | Simple Giveaways – Grow your business, email lists and traffic with contests | 25 | 956 | 2,384 | 400 | | | Non-prefixed global variable |
| #104 | MonsterInsights – Google Analytics Dashboard for WordPress (Website Stats Made Easy) | 25 | 157 | 435 | 2m+ | | | Nonce verification recommended |
| #105 | Participants Database | 25 | 941 | 893 | 7k+ | | | SQL query is not prepared |
| #106 | PDF Importer for WPForms | 25 | 332 | 329 | 400 | | | Non-prefixed global variable |
| #107 | Quttera ThreatSign – Web Malware Scanner for WordPress | 25 | 335 | 471 | 10k+ | | | Non-prefixed global variable |
| #108 | Seers AI | Cookie Consent Banner – GDPR & CCPA Compliant Consent Management Platform | 25 | 1,446 | 421 | 1k+ | | | Output is not escaped |
| #109 | Affiliate Program Suite — SliceWP Affiliates | 25 | 1,291 | 2,089 | 10k+ | | | Output is not escaped |
| #110 | SureDash – Community, Courses & Member Dashboard | 25 | 420 | 810 | 1k+ | | | Non-prefixed global variable |
| #111 | Themify Event Post | 25 | 390 | 146 | 3k+ | | | Output is not escaped |
| #112 | TrackShip for WooCommerce | 25 | 405 | 954 | 6k+ | | | Non-prefixed global variable |
| #113 | TranslatePress – Translate Multilingual sites with AI Translation | 25 | 583 | 1,673 | 400k+ | | | Non-prefixed hook name |
| #114 | Enhanced Ecommerce Google Analytics for WooCommerce | 25 | 909 | 1,506 | 2k+ | | | Non-prefixed global variable |
| #115 | XT Floating Cart for WooCommerce | 25 | 1,232 | 1,985 | 4k+ | | | Non-prefixed global variable |
| #116 | PDF Builder for WooCommerce. Create invoices,packing slips and more | 25 | 372 | 504 | 2k+ | | | Non-prefixed global variable |
| #117 | Product Attachment for WooCommerce | 25 | 1,241 | 1,781 | 6k+ | | | Non-prefixed global variable |
| #118 | WP 2FA – Two-factor authentication for WordPress | 25 | 255 | 717 | 100k+ | | | Non-prefixed global variable |
| #119 | WPvivid Backup for MainWP | 25 | 852 | 1,798 | 10k+ | | | Missing nonce verification |
| #120 | WPvivid — Backup, Migration & Staging | 25 | 903 | 1,461 | 900k+ | | | Non-prefixed namespace |
| #121 | XT Quick View for WooCommerce | 25 | 1,062 | 1,798 | 400 | | | Non-prefixed global variable |
| #122 | Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) | 26 | 98 | 269 | 10k+ | | | error log error log |
| #123 | Login Widget With Shortcode | 26 | 335 | 198 | 6k+ | | | wp function not compatible with requires wp |
| #124 | MaxGalleria | 26 | 278 | 560 | 2k+ | | | Non-prefixed global variable |
| #125 | Omise Payments | 26 | 358 | 256 | 2k+ | | | Output is not escaped |
| #126 | XL NMI Gateway for WooCommerce | 26 | 695 | 436 | 1k+ | | | Text Domain Mismatch |
| #127 | WPCOM Member | 26 | 433 | 638 | 1k+ | | | Non Singular String Literal Domain |
| #128 | Ditty – Responsive News Tickers, Sliders, and Lists | 27 | 561 | 484 | 30k+ | | | Output is not escaped |
| #129 | Loco Translate | 27 | 451 | 226 | 1m+ | | | Output is not escaped |
| #130 | SEO Booster | 27 | 264 | 1,082 | 1k+ | | | Non-prefixed global variable |
| #131 | Verge3D Publishing and E-Commerce | 27 | 245 | 298 | 400 | | | Nonce verification recommended |
| #132 | Video Gallery for WooCommerce – Add Product Video & Featured Video | 27 | 117 | 478 | 4k+ | | | Non-prefixed global variable |
| #133 | WP Events Manager | 27 | 172 | 369 | 30k+ | | | Non-prefixed hook name |
| #134 | WP Activity Log | 27 | 97 | 218 | 300k+ | | | Nonce verification recommended |
| #135 | Duplicate Post | 28 | 448 | 255 | 300k+ | | | Unsafe printing function |
| #136 | Educare – Students & Result Management System | 28 | 1,114 | 1,043 | 800 | | | Missing nonce verification |
| #137 | Event Tickets Manager for WooCommerce | 28 | 182 | 655 | 1k+ | | | Non-prefixed global variable |
| #138 | Advanced Shipping Rates for WooCommerce: Flexible Table Rate Shipping Rules | 28 | 187 | 505 | 2k+ | | | Non-prefixed global variable |
| #139 | JobWP – Job Board Plugin for WordPress | Job Listings, Career Page & Applications | 28 | 872 | 391 | 1k+ | | | Non Singular String Literal Text |
| #140 | Media Hygiene: Remove or Delete Unused Images and More! | 28 | 654 | 309 | 5k+ | | | Non Singular String Literal Domain |
| #141 | Nextend Social Login and Register | 28 | 1,612 | 221 | 200k+ | | | Output is not escaped |
| #142 | Pixel Gallery Addons for Elementor – Easy Grid, Creative Gallery, Drag and Drop Grid, Custom Grid Layout, Portfolio Gallery | 28 | 146 | 259 | 4k+ | | | Post Not In exclude |
| #143 | ReDi Restaurant Reservation – Instant Restaurant Booking & Table Reservation System | 28 | 1,013 | 239 | 800 | | | Unsafe printing function |
| #144 | Connect Matomo – Analytics Dashboard for WordPress | 28 | 100 | 111 | 60k+ | | | Nonce verification recommended |
| #145 | WP Travel Gutenberg Blocks | 28 | 485 | 157 | 900 | | | Output is not escaped |
| #146 | pCloud WP Backup | 29 | 121 | 74 | 1k+ | | | Exception output is not escaped |
| #147 | SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz | 29 | 337 | 198 | 500k+ | | | Text Domain Mismatch |
| #148 | Themify Popup | 29 | 229 | 108 | 8k+ | | | Text Domain Mismatch |
| #149 | Thim Kit for Elementor – Pre-built Templates & Widgets for Elementor | 29 | 255 | 290 | 20k+ | | | Output is not escaped |
| #150 | Xpro Addons — 140+ Widgets for Elementor | 29 | 28 | 827 | 40k+ | | | Non-prefixed global variable |