| #4101 | EDD Hide Download | 65 | 13 | 13 | 600 | | | Output is not escaped |
| #4102 | Email Tracker | 65 | 25 | 4 | 800 | | | SQL query is not prepared |
| #4103 | Live Chat with Messenger Customer Chat | 65 | 10 | 23 | 3k+ | | | Input is not sanitized |
| #4104 | Featured Galleries | 65 | 15 | 10 | 3k+ | | | Output is not escaped |
| #4105 | Futy.io Leadbots | 65 | 73 | 9 | 2k+ | | | wp function not compatible with requires wp |
| #4106 | Genesis Visual Hook Guide | 65 | 13 | 14 | 700 | | | Nonce verification recommended |
| #4107 | HTACCESS IP Blocker | 65 | 5 | 14 | 2k+ | | | Missing nonce verification |
| #4108 | WP All Import – Import SEO Settings for All In One SEO | 65 | 19 | 11 | 900 | | | Output is not escaped |
| #4109 | Integration for Elementor forms – Sendinblue | 65 | 94 | 56 | 7k+ | | | Text Domain Mismatch |
| #4110 | Bitrix24 | 65 | 28 | 10 | 500 | | | Text Domain Mismatch |
| #4111 | Multi Image Metabox | 65 | 17 | 8 | 7k+ | | | Output is not escaped |
| #4112 | MW WP Form reCAPTCHA | 65 | 11 | 14 | 2k+ | | | Input is not sanitized |
| #4113 | Notibar – Notification Bar for WordPress | 65 | 43 | 62 | 8k+ | | | wp function not compatible with requires wp |
| #4114 | Product Image and Video Gallery Slider for WooCommerce | 65 | 13 | 7 | 700 | | | Output is not escaped |
| #4115 | QR Code Composer – Automatic QR Code Generator | 65 | 33 | 2 | 3k+ | | | Output is not escaped |
| #4116 | Read More Excerpt Link | 65 | 19 | 8 | 3k+ | | | Output is not escaped |
| #4117 | Reading progressbar | 65 | 25 | 2 | 6k+ | | | Output is not escaped |
| #4118 | Redirect 404 to Home Page – Custom URL | 65 | 7 | 11 | 4k+ | | | Output is not escaped |
| #4119 | Royal MCP – Secure AI Connector for Claude, ChatGPT & Gemini | 65 | 6 | 33 | 8k+ | | | Interpolated SQL is not prepared |
| #4120 | Slider Revolution Search Replace | 65 | 5 | 14 | 900 | | | Input is not validated |
| #4121 | SocketLabs | 65 | 15 | 18 | 900 | | | Output is not escaped |
| #4122 | SQL Buddy – Database Management Made Easy | 65 | 12 | 16 | 5k+ | | | SQL query is not prepared |
| #4123 | T4B News Ticker – Responsive News Scroller, Slider, and Animations | 65 | 20 | 10 | 7k+ | | | Output is not escaped |
| #4124 | WebberZone Top 10 — Popular Posts | 65 | 37 | 179 | 10k+ | | | Database parameter is not escaped |
| #4125 | User Last Login | 65 | 27 | 5 | 600 | | | Output is not escaped |
| #4126 | Lime Connect (formerly Userlike) – WordPress Live Chat plugin | 65 | 22 | 3 | 900 | | | Output is not escaped |
| #4127 | Web and WooCommerce Addons for WPBakery Builder | 65 | 497 | 123 | 1k+ | | | Text Domain Mismatch |
| #4128 | Vf Expansion | 65 | 58 | 52 | 1k+ | | | Non-prefixed global variable |
| #4129 | VK Link Target Controller | 65 | 13 | 10 | 30k+ | | | Output is not escaped |
| #4130 | Websitescanner Custom Schema | 65 | 28 | 19 | 600 | | | wp function not compatible with requires wp |
| #4131 | Add to Cart Text Changer and Customize Button, Add Custom Icon | 65 | 87 | 18 | 2k+ | | | Text Domain Mismatch |
| #4132 | USPS Simple Shipping for Woocommerce | 65 | 20 | 11 | 8k+ | | | Exception output is not escaped |
| #4133 | AI Product Gallery Slider for WooCommerce, Product Image Zoom, Product Video, Additional Variation Images Gallery – WPBean | 65 | 264 | 16 | 2k+ | | | Text Domain Mismatch |
| #4134 | Ajaxify Comments – Ajax and Lazy Loading Comments | 65 | 20 | 38 | 3k+ | | | Non-prefixed hook name |
| #4135 | WP Change Default From Email | 65 | 51 | 7 | 10k+ | | | Non Singular String Literal Domain |
| #4136 | WP-Farsi | 65 | 26 | 36 | 600 | | | Non-prefixed function |
| #4137 | WP Max Submit Protect | 65 | 19 | 12 | 400 | | | Output is not escaped |
| #4138 | WP SEO HTML Sitemap | 65 | 22 | 15 | 6k+ | | | Output is not escaped |
| #4139 | WPC Free Gift Coupons for WooCommerce | 65 | 8 | 25 | 400 | | | Non-prefixed class |
| #4140 | Admin CSS MU | 64 | 30 | 582 | 10k+ | | | Non-prefixed global variable |
| #4141 | Admin filter posts by year | 64 | 8 | 32 | 400 | | | Non-prefixed function |
| #4142 | Beautiful taxonomy filters | 64 | 38 | 78 | 2k+ | | | Non-prefixed global variable |
| #4143 | Broadly for WordPress | 64 | 18 | 5 | 500 | | | Unsafe printing function |
| #4144 | UniqueID for Contact Form 7 | 64 | 21 | 18 | 2k+ | | | Text Domain Mismatch |
| #4145 | Channel.io | 64 | 14 | 3 | 1k+ | | | Output is not escaped |
| #4146 | CodeColorer | 64 | 65 | 266 | 1k+ | | | Non-prefixed global variable |
| #4147 | Collapsing Archives | 64 | 36 | 9 | 3k+ | | | date date |
| #4148 | Comment Blacklist Manager | 64 | 14 | 8 | 600 | | | Output is not escaped |
| #4149 | Advanced Comment Form | 64 | 68 | 6 | 4k+ | | | Output is not escaped |
| #4150 | Custom Fields Account Registration For Woocommerce | 64 | | 40 | 700 | | | Missing nonce verification |