| #6251 | SEO Auto Linker | 39 | 90 | 24 | 1k+ | | | Text Domain Mismatch |
| #6252 | SEO Friendly Images | 39 | 292 | 20 | 20k+ | | | Output is not escaped |
| #6253 | Serial Number for Contact Form 7 | 39 | 105 | 53 | 2k+ | | | Non Singular String Literal Domain |
| #6254 | Taxonomy Thumbnail | 39 | 27 | 58 | 3k+ | | | Non-prefixed function |
| #6255 | Shared Files – File Upload & Download Manager | 39 | 5 | 184 | 4k+ | | | Nonce verification recommended |
| #6256 | Shipping by Rules for WooCommerce | 39 | 130 | 48 | 500 | | | Output is not escaped |
| #6257 | Shipping Simulator for WooCommerce | 39 | 120 | 39 | 5k+ | | | Text Domain Mismatch |
| #6258 | Show All Comments | 39 | 108 | 92 | 400 | | | Nonce verification recommended |
| #6259 | Simpaisa Wallet (Jazzcash & Easypaisa) Payment Services | 39 | 67 | 74 | 1k+ | | | Interpolated Variable Text |
| #6260 | Simple Membership WP user Import | 39 | 22 | 46 | 4k+ | | | Request data is not unslashed |
| #6261 | Simple Posts Ticker – Easy, Lightweight & Flexible | 39 | 151 | 28 | 2k+ | | | Output is not escaped |
| #6262 | Simple Staff List | 39 | 90 | 236 | 3k+ | | | Non-prefixed global variable |
| #6263 | SimpleModal Login | 39 | 50 | 12 | 700 | | | Unsafe printing function |
| #6264 | SKP WP Admin Login Captcha | 39 | 77 | 18 | 1k+ | | | Output is not escaped |
| #6265 | Slash Admin | 39 | 116 | 38 | 500 | | | Output is not escaped |
| #6266 | Slider Text Scroll | 39 | 95 | 52 | 400 | | | Text Domain Mismatch |
| #6267 | Slideshow SE | 39 | 35 | 240 | 2k+ | | | Non-prefixed global variable |
| #6268 | Smaily for WP | 39 | 52 | 36 | 600 | | | Output is not escaped |
| #6269 | Smart Archives Reloaded | 39 | 78 | 36 | 1k+ | | | Non Singular String Literal Domain |
| #6270 | SMTP | 39 | 54 | 15 | 700 | | | Non Singular String Literal Domain |
| #6271 | Solid Post Likes | 39 | 96 | 52 | 500 | | | Text Domain Mismatch |
| #6272 | Soumettre.fr | 39 | 130 | 26 | 10k+ | | | Text Domain Mismatch |
| #6273 | Spreadr Woocommerce Plugin – Amazon Importer for Dropshipping and Affiliate | 39 | 42 | 226 | 500 | | | Request data is not unslashed |
| #6274 | Stock Ticker | 39 | 92 | 49 | 2k+ | | | Output is not escaped |
| #6275 | Stockdio Historical Chart | 39 | 65 | 16 | 900 | | | Output is not escaped |
| #6276 | Structured Content (JSON-LD) #wpsc | 39 | 291 | 73 | 40k+ | | | Output is not escaped |
| #6277 | Substack Importer | 39 | 33 | 33 | 1k+ | | | Missing nonce verification |
| #6278 | Swifty Image Widget | 39 | 114 | 28 | 900 | | | Output is not escaped |
| #6279 | Sydney Toolbox | 39 | 84 | 62 | 50k+ | | | Unsafe printing function |
| #6280 | Sync Post With Other Site | 39 | 179 | 21 | 3k+ | | | Non Singular String Literal Domain |
| #6281 | Tabify Edit Screen | 39 | 83 | 27 | 500 | | | Output is not escaped |
| #6282 | Tawk.To Manager | 39 | 204 | 21 | 600 | | | Output is not escaped |
| #6283 | Easy Category Icons | 39 | 50 | 43 | 600 | | | Text Domain Mismatch |
| #6284 | ThemeKit For WordPress | 39 | 149 | 49 | 700 | | | Output is not escaped |
| #6285 | OpenHook | 39 | 172 | 22 | 1k+ | | | Unsafe printing function |
| #6286 | TinyMCE Custom Styles | 39 | 297 | 76 | 7k+ | | | Non Singular String Literal Domain |
| #6287 | TinyMCE Spellcheck | 39 | 27 | 32 | 2k+ | | | Unsafe printing function |
| #6288 | TomS reCAPTCHA | 39 | 128 | 256 | 500 | | | Missing nonce verification |
| #6289 | Traffic Monitor | 39 | 6 | 143 | 1k+ | | | Direct Query |
| #6290 | UiChemy — Figma Converter for Elementor, Gutenberg and Bricks | 39 | 8 | 100 | 9k+ | | | Nonce verification recommended |
| #6291 | Ultimate Client Dash | 39 | 697 | 12 | 2k+ | | | Text Domain Mismatch |
| #6292 | Ultimate Lightbox | 39 | 110 | 59 | 1k+ | | | Unsafe printing function |
| #6293 | Universal Google Adsense and Ads manager | 39 | 70 | 31 | 2k+ | | | Unsafe printing function |
| #6294 | Unlimited Background Slider | 39 | 66 | 53 | 600 | | | Output is not escaped |
| #6295 | upPrev | 39 | 35 | 36 | 1k+ | | | Dynamic hook name |
| #6296 | Uptolike Social Share Buttons | 39 | 38 | 33 | 4k+ | | | Output is not escaped |
| #6297 | Use Any Font | Custom Font Uploader | 39 | 36 | 55 | 200k+ | | | Request data is not unslashed |
| #6298 | User Blocker | 39 | 6 | 276 | 3k+ | | | Nonce verification recommended |
| #6299 | UserHeat Plugin | 39 | 121 | 20 | 6k+ | | | Non Singular String Literal Domain |
| #6300 | Accessibility by UserWay | 39 | 22 | 35 | 80k+ | | | Direct Query |