| #1 | Easy WP SMTP – WordPress SMTP and Email Logs: Gmail SMTP, Office 365, Outlook, Custom SMTP, and more | 15 | 45 | 166 | 500k+ | | | Database parameter is not escaped |
| #2 | Visual Composer Website Builder | 16 | 82 | 320 | 40k+ | | | Non-prefixed global variable |
| #3 | Podlove Podcast Publisher | 18 | 2,354 | 1,433 | 3k+ | | | Output is not escaped |
| #4 | JetFormBuilder — Dynamic Blocks Form Builder | 19 | 2,104 | 1,607 | 80k+ | | | Text Domain Mismatch |
| #5 | WP Email Template | 19 | 344 | 345 | 2k+ | | | Exception output is not escaped |
| #6 | WP Import Export Lite | 19 | 737 | 979 | 40k+ | | | Non-prefixed global variable |
| #7 | AweBooking – Hotel Booking System | 20 | 309 | 514 | 1k+ | | | Non-prefixed global variable |
| #8 | Brizy – Page Builder | 20 | 586 | 726 | 70k+ | | | Output is not escaped |
| #9 | Download Monitor | 20 | 423 | 1,364 | 80k+ | | | Non-prefixed hook name |
| #10 | GiveWP – Donation Plugin and Fundraising Platform | 20 | 3,411 | 3,559 | 100k+ | | | Output is not escaped |
| #11 | Leaky Paywall | 20 | 322 | 789 | 600 | | | Nonce verification recommended |
| #12 | Shipping for Nova Poshta | 20 | 598 | 923 | 400 | | | Output is not escaped |
| #13 | Forumax – AI Powered Advanced Community Forum Plugin | 21 | 4,936 | 4,353 | 600 | | | Text Domain Mismatch |
| #14 | eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams | 21 | 186 | 437 | 9k+ | | | Non-prefixed global variable |
| #15 | Feeds for YouTube (YouTube video, channel, and gallery plugin) | 21 | 558 | 978 | 100k+ | | | Output is not escaped |
| #16 | Imagify Image Optimization: Optimize Images | Compress & Convert to WebP/AVIF | 21 | 428 | 862 | 1m+ | | | Non-prefixed global variable |
| #17 | Leyka | 21 | 257 | 3,446 | 2k+ | | | Request data is not unslashed |
| #18 | Modular DS: Monitor, update, and backup multiple websites | 21 | 159 | 82 | 40k+ | | | Exception output is not escaped |
| #19 | PublishPress Planner – Editorial Calendar, Marketing Content, Kanban Board | 21 | 603 | 890 | 6k+ | | | Output is not escaped |
| #20 | TotalPoll for Polls and Contests | 21 | 1,366 | 155 | 1k+ | | | Text Domain Mismatch |
| #21 | Revive Social – Social Media Auto Post and Scheduling Automation Plugin | 21 | 256 | 431 | 20k+ | | | Non-prefixed hook name |
| #22 | UPC/EAN/GTIN Barcode Generator/Importer | 21 | 776 | 311 | 500 | | | Exception output is not escaped |
| #23 | URL Shortify – Simple and Easy URL Shortener | 21 | 1,511 | 2,669 | 10k+ | | | Non-prefixed global variable |
| #24 | Paysera Payment Gateway for WooCommerce | 21 | 1,868 | 196 | 7k+ | | | Exception output is not escaped |
| #25 | PPOM – Product Addons & Custom Fields for WooCommerce | 21 | 336 | 1,319 | 20k+ | | | Non-prefixed global variable |
| #26 | Wordfence Security – Firewall, Malware Scan, and Login Security | 21 | 1,592 | 2,973 | 5m+ | | | Output is not escaped |
| #27 | WebTotem Security | 21 | 1,110 | 213 | 900 | | | Text Domain Mismatch |
| #28 | Cart Lift – Abandoned Cart Recovery for WooCommerce and EDD | 22 | 669 | 769 | 1k+ | | | Output is not escaped |
| #29 | Notification Bar, Announcement and Cookie Notice WordPress Plugin – FooBar | 22 | 1,321 | 1,371 | 3k+ | | | Non-prefixed global variable |
| #30 | GeoDirectory – WP Business Directory Plugin and Classified Listings Directory | 22 | 4,465 | 3,976 | 10k+ | | | Output is not escaped |
| #31 | JCH Optimize | 22 | 1,145 | 136 | 4k+ | | | Output is not escaped |
| #32 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses | 22 | 2,433 | 3,594 | 70k+ | | | Non-prefixed global variable |
| #33 | MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. | 22 | 2,625 | 2,458 | 10k+ | | | Output is not escaped |
| #34 | Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization | 22 | 1,306 | 2,818 | 8k+ | | | Output is not escaped |
| #35 | PDF Builder for WPForms | 22 | 321 | 266 | 900 | | | SQL query is not prepared |
| #36 | Prime Mover – Migrate WordPress Website & Backups | 22 | 1,326 | 1,600 | 10k+ | | | Non-prefixed global variable |
| #37 | RealPress – Real Estate Plugin | 22 | 604 | 1,167 | 400 | | | Non-prefixed global variable |
| #38 | Restrict User Access – Ultimate Membership & Content Protection | 22 | 977 | 1,840 | 10k+ | | | Non-prefixed global variable |
| #39 | SSL Zen — SSL Certificate Installer & HTTPS Redirects | 22 | 751 | 1,605 | 10k+ | | | Non-prefixed global variable |
| #40 | Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent | 22 | 225 | 519 | 8k+ | | | error log error log |
| #41 | 10Web Booster – Website speed optimization, Cache & Page Speed optimizer | 22 | 513 | 601 | 70k+ | | | Non-prefixed global variable |
| #42 | Ultimate Carousel For Divi | 22 | 590 | 1,566 | 800 | | | Non-prefixed global variable |
| #43 | Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin | 22 | 523 | 2,369 | 40k+ | | | Direct Query |
| #44 | Uncanny Toolkit for LearnDash | 22 | 539 | 994 | 20k+ | | | Output is not escaped |
| #45 | Unlimited Elements Blocks Library | 22 | 708 | 1,822 | 400 | | | Non-prefixed global variable |
| #46 | Search & Replace Everything – Quick and Easy Way to Find and Replace Text, Links | 22 | 1,044 | 1,797 | 20k+ | | | Non-prefixed global variable |
| #47 | UpStream: a Project Management Plugin for WordPress | 22 | 683 | 703 | 600 | | | Non-prefixed global variable |
| #48 | Wenprise WeChatPay Payment Gateway For WooCommerce | 22 | 443 | 178 | 400 | | | Exception output is not escaped |
| #49 | WooCommerce | 22 | 1,359 | 6,172 | 7m+ | | | Non-prefixed global variable |
| #50 | WP Express Checkout (Fast Payments via PayPal & Stripe) | 22 | 591 | 627 | 1k+ | | | Output is not escaped |