| #8901 | PDF for WPForms + Drag and Drop Template Builder | 26 | 674 | 113 | 1k+ | | | wp function not compatible with requires wp |
| #8902 | Bangladeshi Payments Mobile – QR Code & Transaction Reports | 26 | 535 | 1,280 | 1k+ | | | Non-prefixed global variable |
| #8903 | VikWidgetsLoader – Collection of Widgets | 26 | 1,182 | 538 | 1k+ | | | Output is not escaped |
| #8904 | FG PrestaShop to WooCommerce | 26 | 254 | 94 | 900 | | | Unsafe printing function |
| #8905 | Subscriber by BestWebSoft | 26 | 550 | 376 | 900 | | | Text Domain Mismatch |
| #8906 | FV Antispam | 26 | 332 | 239 | 900 | | | Output is not escaped |
| #8907 | SV Proven Expert | 26 | 747 | 380 | 900 | | | Output is not escaped |
| #8908 | Set Price Note (Units, Offers, Editions) for WooCommerce | 26 | 596 | 1,307 | 800 | | | Non-prefixed global variable |
| #8909 | Online Contact Widget-多合一在线客服插件 | 26 | 708 | 80 | 800 | | | Non Singular String Literal Domain |
| #8910 | FG Drupal to WordPress | 26 | 275 | 100 | 700 | | | Unsafe printing function |
| #8911 | AI Content Writing Assistant | 26 | 1,069 | 516 | 700 | | | Text Domain Mismatch |
| #8912 | URL Image Importer – Import External Images to the Media Library from URL, CSV & XML | 26 | 143 | 239 | 700 | | | Missing nonce verification |
| #8913 | Portfolio by BestWebSoft – Work and Projects Presentation Plugin for WordPress | 26 | 525 | 240 | 600 | | | Text Domain Mismatch |
| #8914 | MakeStories (for Google Web Stories) | 26 | 117 | 416 | 600 | | | Nonce verification recommended |
| #8915 | Event Monster – Event Manager, Ticket Booking & Registration | 26 | 781 | 781 | 600 | | | Non-prefixed global variable |
| #8916 | Landing Page Cat – Coming Soon & Maintenance Pages | 26 | 91 | 180 | 600 | | | Non-prefixed class |
| #8917 | JustTables – WooCommerce Product Table | 26 | 534 | 652 | 600 | | | Non-prefixed global variable |
| #8918 | RestaurantPress | 26 | 265 | 518 | 600 | | | Output is not escaped |
| #8919 | Parcel Pro | 26 | 171 | 220 | 600 | | | Output is not escaped |
| #8920 | Theater for WordPress | 26 | 348 | 344 | 600 | | | Output is not escaped |
| #8921 | Premmerce User Roles | 26 | 597 | 1,357 | 600 | | | Non-prefixed global variable |
| #8922 | Product Table For WooCommerce | 26 | 191 | 858 | 600 | | | Non-prefixed global variable |
| #8923 | Ultimate Reviews | 26 | 515 | 345 | 500 | | | Output is not escaped |
| #8924 | Conditional Fees for WooCommerce Lite | 26 | 566 | 1,303 | 500 | | | Non-prefixed global variable |
| #8925 | GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites | 26 | 286 | 216 | 500 | | | badly named files |
| #8926 | Conditional Logic for Woo Product Add-ons | 26 | 575 | 1,352 | 500 | | | Non-prefixed global variable |
| #8927 | Integrate Razorpay for Contact Form 7 | 26 | 152 | 97 | 500 | | | curl curl setopt |
| #8928 | WP Frontend Admin – Display WP Admin Pages in the Frontend | 26 | 347 | 337 | 400 | | | Non Singular String Literal Domain |
| #8929 | FlagShip WooCommerce Shipping | 26 | 495 | 188 | 400 | | | Non Singular String Literal Domain |
| #8930 | Site Kit by Google – Analytics, Search Console, AdSense, Speed | 25 | 1,304 | 242 | 5m+ | | | Missing direct file access protection |
| #8931 | MonsterInsights – Google Analytics Dashboard for WordPress (Website Stats Made Easy) | 25 | 116 | 441 | 2m+ | | | Nonce verification recommended |
| #8932 | WordPress Importer | 25 | 238 | 110 | 2m+ | | | Output is not escaped |
| #8933 | Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force Prevention | 25 | 617 | 614 | 1m+ | | | Unsafe printing function |
| #8934 | Smush – Image Optimization, Compression, Lazy Load, WebP & CDN | 25 | 244 | 568 | 1m+ | | | Non-prefixed hook name |
| #8935 | WP Super Cache | 25 | 800 | 989 | 1m+ | | | Output is not escaped |
| #8936 | Smash Balloon Social Photo Feed – Easy Social Feeds Plugin | 25 | 449 | 1,300 | 1m+ | | | Interpolated SQL is not prepared |
| #8937 | Spectra Legacy – Gutenberg Blocks | 25 | 253 | 3,226 | 1m+ | | | Non-prefixed global variable |
| #8938 | Loginizer | 25 | 814 | 504 | 1m+ | | | Output is not escaped |
| #8939 | WPvivid — Backup, Migration & Staging | 25 | 900 | 1,461 | 900k+ | | | Non-prefixed namespace |
| #8940 | Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode | 25 | 99 | 1,040 | 700k+ | | | Non-prefixed global variable |
| #8941 | WP Statistics – Simple, privacy-friendly Google Analytics alternative | 25 | 610 | 2,465 | 600k+ | | | Non-prefixed global variable |
| #8942 | TablePress – Tables in WordPress made easy | 25 | 847 | 2,174 | 600k+ | | | Non-prefixed global variable |
| #8943 | Broken Link Checker | 25 | 727 | 600 | 500k+ | | | Output is not escaped |
| #8944 | TranslatePress – Translate Multilingual sites with AI Translation | 25 | 499 | 1,639 | 400k+ | | | Non-prefixed hook name |
| #8945 | Breeze Cache | 25 | 218 | 800 | 400k+ | | | Non-prefixed global variable |
| #8946 | WP Go Maps – Google Map, OpenStreetMap, Leaflet Map | 25 | 4,996 | 1,008 | 300k+ | | | Unsafe printing function |
| #8947 | Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content | 25 | 681 | 1,517 | 300k+ | | | Non-prefixed global variable |
| #8948 | Smash Balloon Social Post Feed – Simple Social Feeds for WordPress | 25 | 554 | 982 | 200k+ | | | Output is not escaped |
| #8949 | All 404 Redirect to Homepage | 25 | 140 | 301 | 200k+ | | | date date |
| #8950 | Beaver Builder Page Builder – Drag and Drop Website Builder | 25 | 4,463 | 1,819 | 100k+ | | | Text Domain Mismatch |