| #5001 | Songkick Concerts and Festivals | 49 | 9 | 48 | 500 | | | Input is not sanitized |
| #5002 | Friends Link Widget | 49 | 86 | 1 | 500 | | | Output is not escaped |
| #5003 | GamiPress – Multimedia Content | 49 | 11 | 25 | 500 | | | Nonce verification recommended |
| #5004 | CryptAPI Payment Gateway for WooCommerce | 49 | 185 | 23 | 400 | | | Text Domain Mismatch |
| #5005 | Responsive Image Widget | 49 | 43 | 0 | 400 | | | Output is not escaped |
| #5006 | CIO Custom Fields Importer | 49 | 23 | 8 | 400 | | | Output is not escaped |
| #5007 | Simple Post Expiration | 49 | 47 | 10 | 400 | | | Text Domain Mismatch |
| #5008 | Easy Updates Manager | 48 | 13 | 182 | 300k+ | | | Non-prefixed global variable |
| #5009 | Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories | 48 | 63 | 273 | 100k+ | | | Non-prefixed global variable |
| #5010 | Really Simple CSV Importer | 48 | 40 | 8 | 40k+ | | | Output is not escaped |
| #5011 | Jetpack Social | 48 | 829 | 254 | 30k+ | | | Text Domain Mismatch |
| #5012 | AnWP Post Grid and Post Carousel Slider for Elementor | 48 | 758 | 171 | 20k+ | | | Text Domain Mismatch |
| #5013 | Maps Plugin using Google Maps for WordPress – WP Google Map | 48 | 289 | 38 | 10k+ | | | wp function not compatible with requires wp |
| #5014 | Ansar Import – One Click Starter Sites – for Elementor & Themes | 48 | 27 | 116 | 10k+ | | | Non-prefixed global variable |
| #5015 | External Links | 48 | 42 | 13 | 9k+ | | | Output is not escaped |
| #5016 | Hotline Phone Ring | 48 | 16 | 15 | 8k+ | | | Output is not escaped |
| #5017 | WP Login Form | 48 | 14 | 20 | 7k+ | | | Request data is not unslashed |
| #5018 | WP Remote Users Sync | 48 | 355 | 117 | 6k+ | | | Text Domain Mismatch |
| #5019 | Disable Author Pages | 48 | 23 | 5 | 6k+ | | | Unsafe printing function |
| #5020 | WP Google Search | 48 | 45 | 17 | 5k+ | | | Output is not escaped |
| #5021 | Visual Website Optimizer | 48 | 86 | 4 | 5k+ | | | wp function not compatible with requires wp |
| #5022 | Custom Related Products for WooCommerce | 48 | 25 | 10 | 5k+ | | | Text Domain Mismatch |
| #5023 | Instamojo for WooCommerce | 48 | 72 | 44 | 4k+ | | | Text Domain Mismatch |
| #5024 | Convertful – Your Ultimate On-Site Conversion Tool | 48 | 15 | 34 | 3k+ | | | wp function not compatible with requires wp |
| #5025 | ThemeFarmer Companion | 48 | 54 | 51 | 2k+ | | | Missing Version |
| #5026 | Super Simple Google Analytics | 48 | 55 | 3 | 2k+ | | | Output is not escaped |
| #5027 | Taxonomy Switcher | 48 | 22 | 36 | 2k+ | | | Nonce verification recommended |
| #5028 | WP First Letter Avatar | 48 | 40 | 7 | 2k+ | | | Output is not escaped |
| #5029 | Filter Page by Template | 48 | 17 | 20 | 2k+ | | | Nonce verification recommended |
| #5030 | Navigation menu as Dropdown Widget | 48 | 49 | 1 | 2k+ | | | Output is not escaped |
| #5031 | Flutterwave Payment Gateway for WooCommerce | 48 | 14 | 22 | 2k+ | | | Output is not escaped |
| #5032 | Raw HTML Snippets | 48 | 14 | 36 | 2k+ | | | Input is not sanitized |
| #5033 | Conditional Display for Mobile – Mobile Detect Plugin | 48 | 4 | 112 | 2k+ | | | Input is not sanitized |
| #5034 | Current Menu Item for Custom Post Types | 48 | 18 | 30 | 2k+ | | | Non-prefixed global variable |
| #5035 | Add Polylang support for Customizer | 48 | 18 | 20 | 2k+ | | | Nonce verification recommended |
| #5036 | WS Action Scheduler Cleaner | 48 | 13 | 80 | 2k+ | | | error log error log |
| #5037 | JW Player for WordPress | 48 | 288 | 78 | 1k+ | | | Text Domain Mismatch |
| #5038 | Fixed And Sticky Header | 48 | 31 | 7 | 1k+ | | | Output is not escaped |
| #5039 | Custom Header Extended | 48 | 19 | 11 | 1k+ | | | Unsafe printing function |
| #5040 | Virtuaria PagBank / PagSeguro for WooCommerce | 48 | 12 | 160 | 1k+ | | | Non-prefixed global variable |
| #5041 | Tako Movable Comments | 48 | 18 | 39 | 1k+ | | | Input is not sanitized |
| #5042 | WC Provincia Canton Distrito | 48 | 103 | 14 | 1k+ | | | Text Domain Mismatch |
| #5043 | Better Block Patterns | 48 | 77 | 11 | 1k+ | | | Missing direct file access protection |
| #5044 | Advanced Custom Fields – Location Field add-on | 48 | 51 | 6 | 900 | | | Output is not escaped |
| #5045 | Easy Share Solution For WordPress | 48 | 15 | 33 | 900 | | | Output is not escaped |
| #5046 | Custom Background Extended | 48 | 13 | 23 | 800 | | | Input is not validated |
| #5047 | Optinly – Exit Intent, Newsletter Popups, Gamification & Opt-in Forms | 48 | 34 | 14 | 800 | | | Non Singular String Literal Domain |
| #5048 | wp-Monalisa | 48 | 56 | 94 | 700 | | | Direct Query |
| #5049 | Seznam Webmaster | 48 | 47 | 8 | 700 | | | Output is not escaped |
| #5050 | WP Attachment Export | 48 | 16 | 25 | 600 | | | Input is not sanitized |