| #6451 | Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin | 38 | 2 | 457 | 3k+ | | | Input is not sanitized |
| #6452 | WP Terms Popup – Terms and Conditions and Privacy Policy WordPress Popups | 38 | 299 | 58 | 3k+ | | | Non Singular String Literal Domain |
| #6453 | Stock Market Ticker | 38 | 69 | 14 | 3k+ | | | Output is not escaped |
| #6454 | Zoho Campaigns | 38 | 3 | 129 | 3k+ | | | Non-prefixed global variable |
| #6455 | Datafeedr Comparison Sets | 38 | 450 | 53 | 3k+ | | | Output is not escaped |
| #6456 | Open Graphite | 38 | 380 | 204 | 3k+ | | | Unsafe printing function |
| #6457 | Twenty Eleven Theme Extensions | 38 | 35 | 30 | 3k+ | | | Output is not escaped |
| #6458 | Admin Bar Editor – Toolbar Customization with User Role based access & Custom menus | 38 | 56 | 46 | 3k+ | | | Output is not escaped |
| #6459 | ACF-VC Integrator | 38 | 190 | 91 | 3k+ | | | Output is not escaped |
| #6460 | Lana Downloads Manager | 38 | 146 | 78 | 3k+ | | | Unsafe printing function |
| #6461 | Bible Verse of the Day | 38 | 378 | 23 | 3k+ | | | Unsafe printing function |
| #6462 | Admin Bar & Dashboard Access Control | 38 | 94 | 37 | 3k+ | | | Text Domain Mismatch |
| #6463 | Ashe Extra | 38 | 109 | 54 | 3k+ | | | Text Domain Mismatch |
| #6464 | Smart Cookie Kit | 38 | 263 | 81 | 3k+ | | | Output is not escaped |
| #6465 | Gecka Submenu | 38 | 326 | 36 | 3k+ | | | Output is not escaped |
| #6466 | Contact Form 7 – Post Fields | 38 | 167 | 25 | 3k+ | | | Text Domain Mismatch |
| #6467 | WP Maintenance Mode & Site Under Construction | 38 | 72 | 57 | 3k+ | | | Output is not escaped |
| #6468 | Accessibility Tools & Alt Text Finder | 38 | 36 | 56 | 3k+ | | | Text Domain Mismatch |
| #6469 | Admin Tools | 38 | 189 | 10 | 3k+ | | | Unsafe printing function |
| #6470 | LuckyWP Scripts Control | 38 | 186 | 23 | 3k+ | | | Output is not escaped |
| #6471 | Cecabank WooCommerce Plugin | 38 | 63 | 32 | 3k+ | | | Text Domain Mismatch |
| #6472 | PayTR Taksit Tablosu – WooCommerce | 38 | 67 | 39 | 3k+ | | | Non Singular String Literal Domain |
| #6473 | Announcement Bar | 38 | 192 | 61 | 3k+ | | | Non Singular String Literal Domain |
| #6474 | Simple Keyword to Link | 38 | 90 | 49 | 3k+ | | | Non Singular String Literal Domain |
| #6475 | Custom Menu Wizard Widget | 38 | 326 | 30 | 2k+ | | | Output is not escaped |
| #6476 | Simple Google Sitemap XML | 38 | 38 | 8 | 2k+ | | | Output is not escaped |
| #6477 | RSS Feed Widget | 38 | 207 | 89 | 2k+ | | | Unsafe printing function |
| #6478 | Variation Swatches for WooCommerce | 38 | 45 | 65 | 2k+ | | | Output is not escaped |
| #6479 | WholesaleX – B2B & Wholesale Plugin for WooCommerce with Wholesale Prices | 38 | 33 | 181 | 2k+ | | | Non-prefixed global variable |
| #6480 | Decent Comments | 38 | 93 | 28 | 2k+ | | | Output is not escaped |
| #6481 | External Store for Shopify | 38 | 97 | 33 | 2k+ | | | Output is not escaped |
| #6482 | Automatic Post Tagger | 38 | 592 | 307 | 2k+ | | | Output is not escaped |
| #6483 | AWCA – The Great Analytics Insights for Your eStore | 38 | 238 | 143 | 2k+ | | | Output is not escaped |
| #6484 | Podlove Subscribe button | 38 | 148 | 45 | 2k+ | | | Output is not escaped |
| #6485 | Slickstream: Engagement and Conversions | 38 | 100 | 19 | 2k+ | | | Output is not escaped |
| #6486 | Easy WP Cleaner | 38 | 58 | 124 | 2k+ | | | Non-prefixed global variable |
| #6487 | GoDaddy Payments for WooCommerce | 38 | 58 | 65 | 2k+ | | | Output is not escaped |
| #6488 | Quick Download Button | 38 | 34 | 123 | 2k+ | | | Non-prefixed global variable |
| #6489 | imoje | 38 | 62 | 160 | 2k+ | | | Nonce verification recommended |
| #6490 | LinkBoss – Semantic AI Internal Linking | 38 | 28 | 57 | 2k+ | | | Missing Arg Domain |
| #6491 | Goal Tracker – Custom Event Tracking for GA4 | 38 | 541 | 25 | 2k+ | | | Output is not escaped |
| #6492 | VdoCipher: Secure Video Player and Hosting | 38 | 37 | 54 | 2k+ | | | Non-prefixed function |
| #6493 | WP Safe Mode | 38 | 95 | 55 | 2k+ | | | Output is not escaped |
| #6494 | SSLCommerz Payment Gateway | 38 | 21 | 132 | 2k+ | | | Non-prefixed global variable |
| #6495 | EU Cookie Law Compliance | 38 | 151 | 22 | 2k+ | | | Non Singular String Literal Domain |
| #6496 | Broadcast | 38 | 21 | 107 | 1k+ | | | Direct Query |
| #6497 | Twitter for WordPress | 38 | 47 | 24 | 1k+ | | | Output is not escaped |
| #6498 | Social Photo Fetcher | 38 | 151 | 43 | 1k+ | | | Output is not escaped |
| #6499 | Unconfirmed | 38 | 20 | 79 | 1k+ | | | Nonce verification recommended |
| #6500 | mb.YTPlayer for background videos | 38 | 80 | 29 | 1k+ | | | Unsafe printing function |