| #651 | Translate WordPress – Google Language Translator | 26 | 200 | 317 | 100k+ | | | Non-prefixed global variable |
| #652 | GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites | 26 | 286 | 216 | 500 | | | badly named files |
| #653 | Kadence Central – Site Management, Backups, Security, and Reporting | 26 | 462 | 213 | 30k+ | | | Text Domain Mismatch |
| #654 | JustTables – WooCommerce Product Table | 26 | 534 | 652 | 600 | | | Non-prefixed global variable |
| #655 | Kirki – Freeform Page Builder, Website Builder & Customizer | 26 | 192 | 799 | 500k+ | | | Nonce verification recommended |
| #656 | MakeStories (for Google Web Stories) | 26 | 117 | 416 | 600 | | | Nonce verification recommended |
| #657 | Online Contact Widget-多合一在线客服插件 | 26 | 708 | 80 | 800 | | | Non Singular String Literal Domain |
| #658 | OOPSpam Anti-Spam: Spam Protection for WordPress Forms & Comments (No CAPTCHA) | 26 | 272 | 599 | 6k+ | | | Request data is not unslashed |
| #659 | Organic Builder Widgets – Simple WordPress Page Builder | 26 | 1,034 | 125 | 4k+ | | | Output is not escaped |
| #660 | Paytium: Mollie payment forms & donations | 26 | 506 | 551 | 3k+ | | | Unsafe printing function |
| #661 | Portfolio by BestWebSoft – Work and Projects Presentation Plugin for WordPress | 26 | 525 | 240 | 600 | | | Text Domain Mismatch |
| #662 | Post List Designer – Category Post, Recent Post, Post List | 26 | 542 | 1,320 | 1k+ | | | Non-prefixed global variable |
| #663 | Related Posts Thumbnails Plugin for WordPress | 26 | 382 | 198 | 20k+ | | | Output is not escaped |
| #664 | Send Users Email – Email Subscribers, Email Marketing Newsletter | 26 | 188 | 415 | 5k+ | | | Non-prefixed global variable |
| #665 | Sliced Invoices – WordPress Invoice Plugin | 26 | 684 | 455 | 5k+ | | | Output is not escaped |
| #666 | Carousel, Recent Post Slider and Banner Slider | 26 | 528 | 1,409 | 8k+ | | | Non-prefixed global variable |
| #667 | StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart | 26 | 125 | 420 | 2k+ | | | Non-prefixed global variable |
| #668 | SV Proven Expert | 26 | 747 | 380 | 900 | | | Output is not escaped |
| #669 | Tag Groups is the Advanced Way to Display Your Taxonomy Terms | 26 | 351 | 232 | 3k+ | | | Unsafe printing function |
| #670 | Theater for WordPress | 26 | 348 | 344 | 600 | | | Output is not escaped |
| #671 | URL Image Importer – Import External Images to the Media Library from URL, CSV & XML | 26 | 143 | 239 | 700 | | | Missing nonce verification |
| #672 | User Submitted Posts – Enable Users to Submit Posts from the Front End | 26 | 699 | 396 | 10k+ | | | Text Domain Mismatch |
| #673 | VikWidgetsLoader – Collection of Widgets | 26 | 1,205 | 535 | 1k+ | | | Output is not escaped |
| #674 | Cart Abandonment Recovery for WooCommerce – Recover Lost Sales with Automated Emails | 26 | 51 | 325 | 300k+ | | | Direct Query |
| #675 | Parcel Pro | 26 | 171 | 220 | 600 | | | Output is not escaped |
| #676 | Faktur Pro for WooCommerce | 26 | 416 | 218 | 1k+ | | | Text Domain Mismatch |
| #677 | Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) | 26 | 2,652 | 2,093 | 10k+ | | | Text Domain Mismatch |
| #678 | WP Flashy Marketing Automation | 26 | 432 | 186 | 2k+ | | | Text Domain Mismatch |
| #679 | WPCOM Member | 26 | 432 | 638 | 1k+ | | | Non Singular String Literal Domain |
| #680 | Accordions – Responsive Accordion & FAQ Plugin for WordPress | 27 | 554 | 158 | 1k+ | | | Text Domain Mismatch |
| #681 | Divi Torque Lite – Divi Modules for the Divi Builder & Theme | 27 | 149 | 273 | 50k+ | | | Non-prefixed global variable |
| #682 | Amazon Product in a Post Plugin | 27 | 362 | 416 | 800 | | | Output is not escaped |
| #683 | Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms | 27 | 720 | 367 | 5k+ | | | Text Domain Mismatch |
| #684 | WP Zoho for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms – CRM, Bigin | 27 | 692 | 381 | 3k+ | | | Text Domain Mismatch |
| #685 | Church Content – Sermons, Events and More | 27 | 134 | 410 | 4k+ | | | Non-prefixed function |
| #686 | Comment Link Remove and Other Comment Tools | 27 | 691 | 132 | 7k+ | | | Text Domain Mismatch |
| #687 | Contact Form Generator : Creative form builder for WordPress | 27 | 1,076 | 1,510 | 800 | | | Output is not escaped |
| #688 | Duplicate Post | 27 | 447 | 274 | 300k+ | | | Unsafe printing function |
| #689 | Cyrlitera – Transliteration of Links and File Names | 27 | 453 | 204 | 40k+ | | | Output is not escaped |
| #690 | Gallery – Photo Albums Plugin | 27 | 647 | 252 | 2k+ | | | Output is not escaped |
| #691 | Echo Knowledge Base – Documentation, FAQs, Chat & Smart Search | 27 | 289 | 751 | 10k+ | | | Output is not escaped |
| #692 | Events Calendar for GeoDirectory | 27 | 1,262 | 462 | 2k+ | | | Text Domain Mismatch |
| #693 | Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin | 27 | 122 | 135 | 3k+ | | | Non-prefixed global variable |
| #694 | Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin | 27 | 212 | 497 | 2k+ | | | Non-prefixed global variable |
| #695 | Login for Google Apps | 27 | 139 | 85 | 10k+ | | | Exception output is not escaped |
| #696 | GSpeech TTS – WordPress Text To Speech Plugin | 27 | 842 | 333 | 3k+ | | | Output is not escaped |
| #697 | My Private Site – Make Your Whole Site Private, Force Login & Block Registration Spam | 27 | 713 | 321 | 10k+ | | | Text Domain Mismatch |
| #698 | Magical Shop Builder – WooCommerce Template Builder for Elementor | Shop, Cart, Checkout & Product Page Builder | 27 | 76 | 459 | 3k+ | | | Non-prefixed namespace |
| #699 | MakeCommerce for WooCommerce | 27 | 826 | 452 | 3k+ | | | Text Domain Mismatch |
| #700 | Online Booking & Scheduling Calendar for WordPress by vcita | 27 | 473 | 161 | 1k+ | | | Output is not escaped |