| #451 | Simple Social Icons | 97 | 4 | 3 | 100k+ | | | Missing direct file access protection |
| #452 | Connect Matomo – Analytics Dashboard for WordPress | 28 | 100 | 102 | 60k+ | | | Missing Translators Comment |
| #453 | Translate WordPress with Weglot – Multilingual AI Translation | 95 | | 131 | 50k+ | | | Non-prefixed global variable |
| #454 | WP All Export – Drag & Drop Export to Any Custom CSV, XML & Excel | 35 | 41 | 10 | 100k+ | | | wp function not compatible with requires wp |
| #455 | Master Slider – Responsive Touch Slider | 23 | 800 | 408 | 60k+ | | | Output is not escaped |
| #456 | Search & Replace | 36 | 50 | 53 | 100k+ | | | Missing nonce verification |
| #457 | Instant Images – One-click Image Uploads from Unsplash, Openverse, Pixabay, Pexels, and Giphy | 63 | 31 | 16 | 100k+ | | | Missing direct file access protection |
| #458 | Advanced Google reCAPTCHA | 97 | 3 | 15 | 200k+ | | | Non-prefixed global variable |
| #459 | WP-DBManager | 27 | 386 | 304 | 60k+ | | | Non-prefixed global variable |
| #460 | My Calendar – Accessible Event Manager | 25 | 10 | 2,205 | 20k+ | | | Non-prefixed function |
| #461 | Simple Custom CSS Plugin | 88 | 17 | 5 | 100k+ | | | wp function not compatible with requires wp |
| #462 | YITH WooCommerce Product Gallery & Image Zoom | 24 | 418 | 1,490 | 20k+ | | | Non-prefixed global variable |
| #463 | Export and Import Users and Customers | 68 | 223 | 662 | 60k+ | | | Non-prefixed global variable |
| #464 | RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator | 77 | 37 | 282 | 40k+ | | | Non-prefixed global variable |
| #465 | Intuitive Custom Post Order | 75 | 19 | 96 | 400k+ | | | Direct Query |
| #466 | Simple 301 Redirects By BetterLinks – Easy WordPress Redirect Manager for Redirects, 404 Error Log & More | 41 | 43 | 61 | 100k+ | | | Request data is not unslashed |
| #467 | DearFlip – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer | 92 | 10 | 11 | 200k+ | | | Missing direct file access protection |
| #468 | PHP Compatibility Checker | 97 | 42 | 5 | 200k+ | | | Text Domain Mismatch |
| #469 | Matomo Analytics – Powerful, Privacy-First Insights for WordPress | 19 | 1,911 | 877 | 100k+ | | | Exception output is not escaped |
| #470 | Visual Composer Website Builder | 16 | 82 | 320 | 40k+ | | | Non-prefixed global variable |
| #471 | Ivory Search – WordPress Search Plugin | 24 | 1,173 | 1,688 | 100k+ | | | Non-prefixed global variable |
| #472 | Nimble Page Builder | 20 | 1,591 | 1,684 | 30k+ | | | Missing Arg Domain |
| #473 | Simple Lightbox | 41 | 21 | 48 | 100k+ | | | Nonce verification recommended |
| #474 | 10WebSocial | 28 | 584 | 185 | 10k+ | | | Unsafe printing function |
| #475 | Menu Cart for WooCommerce | 92 | 102 | 16 | 80k+ | | | Text Domain Mismatch |
| #476 | Cost Calculator Builder | 21 | 322 | 766 | 30k+ | | | Non-prefixed global variable |
| #477 | Ecwid by Lightspeed Ecommerce Shopping Cart | 23 | 339 | 307 | 20k+ | | | Missing direct file access protection |
| #478 | OttoKit: All-in-One Automation Platform | 25 | 1,558 | 1,825 | 90k+ | | | Missing direct file access protection |
| #479 | Post Grid Gutenberg Blocks – PostX | 29 | 118 | 404 | 40k+ | | | Non-prefixed global variable |
| #480 | Variation Swatches for WooCommerce – Color, Image & Size Swatches | 86 | 2 | 17 | 200k+ | | | Request data is not unslashed |
| #481 | Termly – GDPR/CCPA Cookie Consent Banner | 38 | 54 | 92 | 80k+ | | | Non-prefixed global variable |
| #482 | Discount Rules for WooCommerce | 71 | 10 | 454 | 100k+ | | | Non-prefixed global variable |
| #483 | WooSidebars | 40 | 43 | 37 | 100k+ | | | Missing Translators Comment |
| #484 | Secure Copy Content Protection and Content Locking | 25 | 958 | 799 | 20k+ | | | Output is not escaped |
| #485 | Lightbox & Modal Popup WordPress Plugin – FooBox | 25 | 610 | 1,365 | 100k+ | | | Non-prefixed global variable |
| #486 | Permalink Manager Lite | 100 | 1 | 1 | 100k+ | | | Missing Translators Comment |
| #487 | Advanced Database Cleaner – Optimize & Clean Database to Speed Up Site Performance | 30 | 173 | 479 | 100k+ | | | Interpolated SQL is not prepared |
| #488 | Web Stories | 84 | 12 | 63 | 60k+ | | | Non-prefixed global variable |
| #489 | Disable and Remove Google Fonts | GDPR & DSGVO friendly | 35 | 21 | 8 | 100k+ | | | Missing Translators Comment |
| #490 | WPC Smart Wishlist for WooCommerce | 41 | 47 | 38 | 100k+ | | | Output is not escaped |
| #491 | Check & Log Email – Easy Email Testing & Mail logging | 98 | 3 | 10 | 100k+ | | | Non-prefixed constant |
| #492 | Security Plugin, Firewall & Malware Scanner with Auto Removal | 24 | 1,188 | 770 | 30k+ | | | Output is not escaped |
| #493 | Ditty – Responsive News Tickers, Sliders, and Lists | 26 | 561 | 484 | 30k+ | | | Output is not escaped |
| #494 | Bold Page Builder | 91 | 12 | 38 | 40k+ | | | Not In Footer |
| #495 | Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … | 93 | 25 | 32 | 20k+ | | | Missing direct file access protection |
| #496 | LoginWP (Formerly Peter's Login Redirect) | 26 | 401 | 278 | 90k+ | | | Output is not escaped |
| #497 | Customizer Export/Import | 47 | 14 | 15 | 100k+ | | | Unsafe printing function |
| #498 | Ninja Tables – Easy Data Table Builder | 100 | | 0 | 80k+ | | | No open findings |
| #499 | Conversios: Google Analytics (GA4), Google Ads, Conversion and Analytics Tracking for Multi-Channels | 24 | 112 | 1,497 | 10k+ | | | Non-prefixed global variable |
| #500 | Mailgun for WordPress | 31 | 144 | 75 | 80k+ | | | Unsafe printing function |