| #201 | Copy Anything to Clipboard for WordPress – Copy Button, Copy Text & Copy Code | 31 | 525 | 131 | 10k+ | | | Text Domain Mismatch |
| #202 | DirectoryPress Frontend | 31 | 402 | 563 | 800 | | | Non-prefixed global variable |
| #203 | Download Plugin | 31 | 78 | 102 | 60k+ | | | Output is not escaped |
| #204 | FraudLabs Pro for WooCommerce | 31 | 169 | 213 | 1k+ | | | Request data is not unslashed |
| #205 | WP Gravity Forms Constant Contact Plugin | 31 | 684 | 164 | 600 | | | Text Domain Mismatch |
| #206 | Image Hotspot – Map Image Annotation | 31 | 95 | 287 | 3k+ | | | Non-prefixed global variable |
| #207 | ImgSEO – AI Image Alt Text Generator & Image SEO Tools | 31 | 1 | 677 | 400 | | | Direct Query |
| #208 | Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity | 31 | 122 | 131 | 2k+ | | | Output is not escaped |
| #209 | MainWP Dashboard: Self-hosted WordPress Management for Agencies | 31 | 95 | 317 | 20k+ | | | Interpolated SQL is not prepared |
| #210 | Raffle Play Woocommerce | 31 | 151 | 199 | 800 | | | Output is not escaped |
| #211 | reCAPTCHA in WP comments form | 31 | 264 | 60 | 8k+ | | | Output is not escaped |
| #212 | Social Share Buttons | 31 | 462 | 156 | 1k+ | | | Text Domain Mismatch |
| #213 | Slider Carousel – Image Slider | 31 | 224 | 1,233 | 3k+ | | | Request data is not unslashed |
| #214 | Team Builder – Team Member Showcase With Grid and slider, Compatible With Elementor, Gutenberg | 31 | 459 | 282 | 7k+ | | | Non Singular String Literal Domain |
| #215 | Big File Uploads – Increase Maximum File Upload Size | 31 | 101 | 92 | 100k+ | | | Output is not escaped |
| #216 | WPGatsby | 31 | 125 | 55 | 3k+ | | | Text Domain Mismatch |
| #217 | WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More | 31 | 167 | 332 | 5m+ | | | Non-prefixed global variable |
| #218 | WPDoctor Malware Scanner & Vulnerability Checker & IP blocker with Hack monitor Lite | 31 | 133 | 438 | 600 | | | Non-prefixed global variable |
| #219 | Better Robots.txt – AI-Ready Crawl Control & Bot Governance | 32 | 55 | 83 | 5k+ | | | error log error log |
| #220 | Color and Image Swatches for Variable Product Attributes | 32 | 173 | 111 | 1k+ | | | Output is not escaped |
| #221 | Contact Form Builder by vcita | 32 | 666 | 174 | 700 | | | Text Domain Mismatch |
| #222 | Muslim Prayer Time-Salah/Iqamah | 32 | 155 | 179 | 400 | | | date date |
| #223 | Moyasar | 32 | 539 | 221 | 700 | | | Text Domain Mismatch |
| #224 | Opal Mega Menu | 32 | 419 | 119 | 400 | | | Text Domain Mismatch |
| #225 | Organization chart | 32 | 187 | 334 | 5k+ | | | SQL query is not prepared |
| #226 | Pagination by BestWebSoft – Customizable WordPress Content Splitter and Navigation Plugin | 32 | 446 | 173 | 5k+ | | | Text Domain Mismatch |
| #227 | Account Engagement | 32 | 115 | 74 | 2k+ | | | Output is not escaped |
| #228 | Showcase IDX Real Estate Search & Lead Capture | 32 | 123 | 52 | 2k+ | | | Output is not escaped |
| #229 | TK Google Fonts GDPR Compliant | 32 | 582 | 34 | 1k+ | | | Output is not escaped |
| #230 | Multi Currency For WooCommerce | 32 | 87 | 70 | 1k+ | | | Non-prefixed global variable |
| #231 | WPCasa – Real Estate for WordPress | 32 | 85 | 429 | 1k+ | | | Non-prefixed global variable |
| #232 | Privacy Policy Generator – WPLP Legal Pages | 32 | 26 | 409 | 10k+ | | | Non-prefixed global variable |
| #233 | Yoo Slider – Image Slider & Video Slider | 32 | 744 | 209 | 600 | | | Output is not escaped |
| #234 | Affiliate Program & Referral Tracking for WooCommerce & WordPress – Affilia | 33 | 80 | 172 | 500 | | | Nonce verification recommended |
| #235 | AWeber – Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth | 33 | 33 | 229 | 9k+ | | | Non-prefixed global variable |
| #236 | Awesome Widgets for SiteOrigin Page Builder | 33 | 314 | 59 | 500 | | | Text Domain Mismatch |
| #237 | Activity Plus Reloaded for BuddyPress | 33 | 88 | 93 | 1k+ | | | Output is not escaped |
| #238 | Five Star Business Profile and Schema | 33 | 289 | 138 | 7k+ | | | Output is not escaped |
| #239 | CB Custom Beaver Builder Modules | 33 | 748 | 4 | 1k+ | | | Output is not escaped |
| #240 | Conekta Payment Gateway | 33 | 240 | 66 | 2k+ | | | Text Domain Mismatch |
| #241 | Fastly | 33 | 221 | 66 | 1k+ | | | Text Domain Mismatch |
| #242 | GDPR Cookie Compliance – Cookie Banner, Cookie Consent, Cookie Notice for CCPA, EU Cookie Law | 33 | 48 | 370 | 300k+ | | | Non-prefixed global variable |
| #243 | GetResponse Forms by Optin Cat | 33 | 68 | 138 | 1k+ | | | Missing direct file access protection |
| #244 | Ultimate Addons for Elementor | 33 | 81 | 291 | 2m+ | | | Non-prefixed class |
| #245 | Mentions légales [FR] | 33 | 238 | 48 | 2k+ | | | Text Domain Mismatch |
| #246 | Intagrate Lite | 33 | 94 | 152 | 4k+ | | | date date |
| #247 | Janolaw AGB Hosting | 33 | 198 | 11 | 1k+ | | | Short PHP open tag found |
| #248 | JetWidgets for Elementor and WooCommerce | 33 | 187 | 146 | 7k+ | | | Text Domain Mismatch |
| #249 | jQuery Manager for WordPress | 33 | 86 | 24 | 7k+ | | | Output is not escaped |
| #250 | MailUp for WordPress – Email and Newsletter Subscription Form | 33 | 251 | 100 | 2k+ | | | Text Domain Mismatch |