| #1001 | bookingflow Smoobu for WP | 35 | 107 | 12 | 400 | | | Text Domain Mismatch |
| #1002 | Bootstrap for Contact Form 7 | 35 | 35 | 73 | 10k+ | | | Nonce verification recommended |
| #1003 | BuddyPress Activity Filter | 35 | 25 | 66 | 400 | | | Nonce verification recommended |
| #1004 | BTCPay Server – Accept Bitcoin payments in WooCommerce | 35 | 48 | 86 | 1k+ | | | Missing nonce verification |
| #1005 | Buying Buddy IDX CRM – Real Estate MLS Plugin | 35 | 71 | 240 | 500 | | | Request data is not unslashed |
| #1006 | Divi Carousel Lite – Responsive Carousel & Slider Modules for Divi Builder | 35 | 381 | 7 | 6k+ | | | Text Domain Mismatch |
| #1007 | CatFolders – WordPress Media Library Folders & Categories | 35 | 35 | 76 | 6k+ | | | Direct Query |
| #1008 | ChatHelp – Click to Chat Button, WooCommerce Chat to Order & Floating Chat Form | 35 | 31 | 188 | 1k+ | | | Non-prefixed global variable |
| #1009 | CiviCRM Profile Sync | 35 | 31 | 140 | 600 | | | Non-prefixed global variable |
| #1010 | Flexible SSL for CloudFlare | 35 | 9 | 6 | 100k+ | | | Output is not escaped |
| #1011 | Constant Contact Forms | 35 | 41 | 89 | 20k+ | | | Missing nonce verification |
| #1012 | CubeWP Framework | 35 | 114 | 71 | 4k+ | | | wp function not compatible with requires wp |
| #1013 | Custom Order Status for WooCommerce | 35 | 41 | 55 | 10k+ | | | Non-prefixed hook name |
| #1014 | Customizer Backup & Reset | 35 | 8 | 10 | 7k+ | | | Output is not escaped |
| #1015 | Dadevarzan WordPress Common | 35 | 56 | 71 | 700 | | | Text Domain Mismatch |
| #1016 | DarkLooks – Dark Mode Switcher For WordPress | 35 | 195 | 21 | 900 | | | Text Domain Mismatch |
| #1017 | DOOFINDER Search and Discovery for WP & WooCommerce | 35 | 151 | 120 | 2k+ | | | Text Domain Mismatch |
| #1018 | Gutenberg Blocks Library & Toolkit – Editor Plus | 35 | 27 | 11 | 6k+ | | | Text Domain Mismatch |
| #1019 | Elementor Website Builder – more than just a page builder | 35 | 46 | 428 | 10m+ | | | Non-prefixed global variable |
| #1020 | WP Rocket | Simple LoadCSS Preloader | 35 | 7 | 16 | 4k+ | | | Non-prefixed global variable |
| #1021 | Connect WooCommerce to ActiveCampaign by EqualServing | 35 | 135 | 89 | 1k+ | | | Text Domain Mismatch |
| #1022 | Ever Compare – Products Compare Plugin for WooCommerce | 35 | 2 | 23 | 600 | | | Non-prefixed global variable |
| #1023 | Extendify | 35 | 80 | 64 | 500k+ | | | Text Domain Mismatch |
| #1024 | F4 Shipping Phone and E-Mail for WooCommerce | 35 | 21 | 30 | 800 | | | Non-prefixed hook name |
| #1025 | WP2Social Auto Publish | 35 | 643 | 215 | 9k+ | | | Unsafe printing function |
| #1026 | Pixel Cat – Conversion Pixel Manager | 35 | 253 | 215 | 40k+ | | | Output is not escaped |
| #1027 | Reviews Widgets for Google, TripAdvisor, Yelp & Recommendations | 35 | 255 | 225 | 10k+ | | | Output is not escaped |
| #1028 | Windows Compatibility Fix | 35 | 13 | 6 | 1k+ | | | Plugin Directory Write |
| #1029 | Flexible Checkout Fields for WooCommerce – WooCommerce Checkout Manager | 35 | 64 | 64 | 80k+ | | | Non-prefixed global variable |
| #1030 | Flexible PDF Invoices for WooCommerce & WordPress | 35 | 15 | 55 | 6k+ | | | Non-prefixed global variable |
| #1031 | Friendly Captcha for WordPress | 35 | 192 | 62 | 9k+ | | | Output is not escaped |
| #1032 | FrontBlocks for Gutenberg/GeneratePress | 35 | 10 | 7 | 500 | | | Offloaded Content |
| #1033 | Full Width Banner Slider Wp | 35 | 239 | 140 | 2k+ | | | Output is not escaped |
| #1034 | GA4WP – Analytics Dashboard for the Website | 35 | 434 | 157 | 2k+ | | | Text Domain Mismatch |
| #1035 | GeoTargeting Lite – WordPress Geolocation | 35 | 66 | 79 | 1k+ | | | Output is not escaped |
| #1036 | Google Analytics Opt-Out | 35 | 34 | 7 | 5k+ | | | Output is not escaped |
| #1037 | Reviews Block for Google | 35 | 244 | 35 | 1k+ | | | Missing Arg Domain |
| #1038 | Gravity Forms: Multiple Form Instances | 35 | 6 | 6 | 700 | | | Hidden files included |
| #1039 | Heartbeat Control | 35 | 27 | 18 | 80k+ | | | Missing Arg Domain |
| #1040 | HivePress – Business Directory, Listings & Classified Ads Plugin | 35 | 38 | 180 | 10k+ | | | Direct Query |
| #1041 | HT Form Widget for Elementor and WPForms | 35 | 8 | 9 | 2k+ | | | Output is not escaped |
| #1042 | Iframely – WP media embeds, cards and blocks | 35 | 136 | 43 | 2k+ | | | Unsafe printing function |
| #1043 | Import Users & Customers with Meta | WP Ultimate CSV Importer Add-on | 35 | 27 | 140 | 5k+ | | | Interpolated SQL is not prepared |
| #1044 | Woody Code Snippets – Insert PHP, CSS, JS, and Header/Footer Scripts | 35 | 64 | 91 | 60k+ | | | Output is not escaped |
| #1045 | Inspiro Starter Sites – 20+ Free Demo Templates for Gutenberg & Elementor | 35 | 6 | 200 | 10k+ | | | Non-prefixed global variable |
| #1046 | Social Feed Gallery | 35 | 104 | 52 | 80k+ | | | Text Domain Mismatch |
| #1047 | Instapage Plugin | 35 | 220 | 45 | 4k+ | | | Output is not escaped |
| #1048 | Japanese font for WordPress(Previously: Japanese Font for TinyMCE) | 35 | 11 | 37 | 10k+ | | | Non-prefixed global variable |
| #1049 | JetStyleManager for Gutenberg | 35 | 20 | 64 | 20k+ | | | Nonce verification recommended |
| #1050 | Jetpack VideoPress | 35 | 710 | 241 | 7k+ | | | Text Domain Mismatch |