| #601 | Auto Affiliate Links | 24 | 381 | 416 | 3k+ | | | Output is not escaped |
| #602 | WP Contact Slider – Contact Form Slider Widget | 24 | 1,355 | 2,589 | 9k+ | | | Non-prefixed global variable |
| #603 | WP Discourse | 24 | 103 | 114 | 1k+ | | | Nonce verification recommended |
| #604 | Iptanus File Upload | 24 | 509 | 1,325 | 10k+ | | | Non-prefixed function |
| #605 | WP Frontend Delete Account | 24 | 537 | 1,378 | 4k+ | | | Non-prefixed global variable |
| #606 | WP Job Portal – AI-Powered Recruitment System for Company or Job Board website | 24 | 78 | 1,158 | 8k+ | | | Missing Version |
| #607 | WP-Members Membership Plugin | 24 | 669 | 382 | 50k+ | | | Output is not escaped |
| #608 | WP Meta and Date Remover | 24 | 665 | 1,314 | 90k+ | | | Non-prefixed global variable |
| #609 | WP Notification Bell | 24 | 736 | 1,591 | 700 | | | Non-prefixed global variable |
| #610 | پارسی دیت – Parsi Date | 24 | 106 | 291 | 100k+ | | | Non-prefixed hook name |
| #611 | WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars | 24 | 861 | 1,573 | 10k+ | | | Non-prefixed global variable |
| #612 | WP Recipe Maker | 24 | 494 | 942 | 50k+ | | | Non-prefixed global variable |
| #613 | WSMS (formerly WP SMS) – SMS & MMS Notifications with OTP and 2FA for WooCommerce | 24 | 91 | 1,725 | 7k+ | | | Non-prefixed hook name |
| #614 | WP-Stateless – Google Cloud Storage | 24 | 1,036 | 482 | 4k+ | | | Non Singular String Literal Domain |
| #615 | WP Travel Engine – Tour Booking Plugin – Tour Operator Software | 24 | 2,012 | 5,689 | 20k+ | | | Non-prefixed global variable |
| #616 | WP User Manager – User Profile Builder & Membership | 24 | 787 | 539 | 10k+ | | | Exception output is not escaped |
| #617 | WP Voting Contest Lite | 24 | 259 | 258 | 400 | | | Text Domain Mismatch |
| #618 | WPeMatico RSS Feed Fetcher | 24 | 1,378 | 587 | 10k+ | | | Output is not escaped |
| #619 | WPIDE – File Manager & Code Editor | 24 | 612 | 1,399 | 40k+ | | | Non-prefixed global variable |
| #620 | XT Variation Swatches for WooCommerce | 24 | 1,033 | 1,809 | 500 | | | Non-prefixed global variable |
| #621 | YayCurrency – WooCommerce Multi-Currency Switcher | 24 | 373 | 623 | 8k+ | | | Text Domain Mismatch |
| #622 | Jetpack CRM – Clients, Leads, Invoices, Billing, Email Marketing, & Automation | 24 | 1,211 | 3,152 | 30k+ | | | Non-prefixed global variable |
| #623 | 3DPrint Lite | 25 | 175 | 1,029 | 700 | | | Non-prefixed global variable |
| #624 | Dynamic Pricing With Discount Rules for WooCommerce | 25 | 165 | 205 | 5k+ | | | Non-prefixed global variable |
| #625 | Adminify – White Label, Admin Menu Editor, Login Customizer | 25 | 546 | 1,379 | 7k+ | | | Non-prefixed global variable |
| #626 | AdRotate Banner Manager | 25 | 1,363 | 846 | 20k+ | | | Unsafe printing function |
| #627 | Advanced Floating Content Lite | 25 | 643 | 1,348 | 7k+ | | | Non-prefixed global variable |
| #628 | AF Companion – Starter Sites, Speed Booster & Growth Suite for Professional Publishing | 25 | 665 | 1,486 | 10k+ | | | Non-prefixed global variable |
| #629 | FiboSearch – Ajax Search for WooCommerce | 25 | 603 | 302 | 100k+ | | | Output is not escaped |
| #630 | AliExpress Dropshipping Plugin for WooCommerce Stores | 25 | 555 | 734 | 4k+ | | | Text Domain Mismatch |
| #631 | AIO Forms – Craft Complex Forms Easily | 25 | 189 | 418 | 700 | | | Mixed line endings |
| #632 | Booking for Appointments and Events Calendar – Amelia | 25 | 1,487 | 480 | 90k+ | | | Exception output is not escaped |
| #633 | Appointment Booking Calendar | 25 | 327 | 1,055 | 1k+ | | | Non-prefixed global variable |
| #634 | Appointment Hour Booking – Booking Calendar | 25 | 262 | 1,253 | 10k+ | | | Non-prefixed global variable |
| #635 | Beaver Builder Page Builder – Drag and Drop Website Builder | 25 | 4,463 | 1,819 | 100k+ | | | Text Domain Mismatch |
| #636 | BlockSpare – Gutenberg Post Grid Blocks for News, Magazine & Blog Websites | 25 | 1,327 | 1,714 | 10k+ | | | Non-prefixed global variable |
| #637 | Booking Activities | 25 | 1,036 | 1,469 | 3k+ | | | Output is not escaped |
| #638 | Booking Calendar Contact Form | 25 | 371 | 884 | 500 | | | Input is not validated |
| #639 | Booking Package | 25 | 1,697 | 3,977 | 10k+ | | | Missing nonce verification |
| #640 | Online Scheduling and Appointment Booking System – Bookly | 25 | 1,088 | 888 | 60k+ | | | SQL query is not prepared |
| #641 | Breeze Cache | 25 | 218 | 800 | 400k+ | | | Non-prefixed global variable |
| #642 | Broken Link Checker | 25 | 727 | 600 | 500k+ | | | Output is not escaped |
| #643 | BuddyPress Docs | 25 | 284 | 421 | 7k+ | | | Nonce verification recommended |
| #644 | Bulk Edit Categories and Tags – Create Thousands Quickly on the Editor | 25 | 1,041 | 1,016 | 4k+ | | | Text Domain Mismatch |
| #645 | Bulk Edit and Create User Profiles – WP Sheet Editor | 25 | 995 | 1,001 | 1k+ | | | Text Domain Mismatch |
| #646 | PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus | 25 | 362 | 1,586 | 100k+ | | | Non-prefixed global variable |
| #647 | SilentShield – Captcha & Anti-Spam for WordPress (CF7, WPForms, Elementor, WooCommerce) | 25 | 235 | 214 | 10k+ | | | Database parameter is not escaped |
| #648 | GSheetConnector for CF7 – Connect Contact Form 7 to Google Sheets and Send Form Submissions in Real Time | 25 | 614 | 1,431 | 40k+ | | | Non-prefixed global variable |
| #649 | CheckoutWC Lite – Conversion optimized WooCommerce checkout | 25 | 1,416 | 854 | 3k+ | | | Text Domain Mismatch |
| #650 | CheckView – Form & Checkout Testing | 25 | 66 | 337 | 1k+ | | | Direct Query |