| #101 | Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder | 55 | 54 | 692 | 700k+ | | | Non-prefixed hook name |
| #102 | Click to Chat – HoliThemes | 99 | 6 | 2 | 700k+ | | | badly named files |
| #103 | HubSpot All-In-One Marketing – Forms, Popups, Live Chat | 97 | 6 | 4 | 200k+ | | | Missing direct file access protection |
| #104 | SEOPress – AI SEO Plugin & On-site SEO | 32 | 138 | 429 | 300k+ | | | Non-prefixed global variable |
| #105 | LightStart – Maintenance Mode, Coming Soon and Landing Page Builder | 34 | 42 | 312 | 400k+ | | | Request data is not unslashed |
| #106 | PixelYourSite – Your smart PIXEL (TAG) & API Manager | 24 | 1,160 | 2,407 | 500k+ | | | Non-prefixed namespace |
| #107 | Photo Gallery by 10Web – Mobile-Friendly Image Gallery | 23 | 4,159 | 1,553 | 100k+ | | | Output is not escaped |
| #108 | Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App | 22 | 1,581 | 2,326 | 300k+ | | | Non-prefixed global variable |
| #109 | ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF | 22 | 1,044 | 800 | 300k+ | | | Non-prefixed global variable |
| #110 | TranslatePress – Translate Multilingual sites with AI Translation | 25 | 455 | 1,545 | 400k+ | | | Non-prefixed function |
| #111 | Royal Addons for Elementor – Addons and Templates Kit for Elementor | 21 | 13,011 | 2,530 | 600k+ | | | Text Domain Mismatch |
| #112 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder | 24 | 826 | 1,314 | 600k+ | | | Non-prefixed global variable |
| #113 | AMP for WP – Accelerated Mobile Pages | 41 | 656 | 2,401 | 80k+ | | | Non-prefixed global variable |
| #114 | Ad Inserter – Ad Manager & AdSense Ads | 24 | 4,260 | 812 | 300k+ | | | Output is not escaped |
| #115 | AddToAny Share Buttons | 37 | 123 | 164 | 300k+ | | | Unsafe printing function |
| #116 | Widgets for Google Reviews | 95 | | 344 | 900k+ | | | Non-prefixed global variable |
| #117 | Imagify Image Optimization: Optimize Images | Compress & Convert to WebP/AVIF | 21 | 426 | 862 | 1m+ | | | Non-prefixed global variable |
| #118 | Easy Table of Contents | 99 | 4 | 4 | 600k+ | | | Non-prefixed constant |
| #119 | Maintenance | 99 | 3 | 0 | 1m+ | | | strip tags strip tags |
| #120 | MalCare WordPress Security Plugin – Malware Scanner, Cleaner, Security Firewall | 82 | 55 | 22 | 200k+ | | | Missing direct file access protection |
| #121 | Better Search Replace | 97 | | 1 | 1m+ | | | Database parameter is not escaped |
| #122 | Hostinger Tools | 82 | 13 | 22 | 3m+ | | | wp function not compatible with requires wp |
| #123 | WPvivid — Backup, Migration & Staging | 25 | 900 | 1,461 | 900k+ | | | Non-prefixed namespace |
| #124 | Joinchat – Enhanced "click to chat" | 81 | 17 | 32 | 700k+ | | | wp function not compatible with requires wp |
| #125 | Blocksy Companion | 81 | | 1,069 | 300k+ | | | Non-prefixed global variable |
| #126 | Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder | 22 | 409 | 236 | 700k+ | | | Text Domain Mismatch |
| #127 | Breadcrumb NavXT | 36 | 102 | 111 | 800k+ | | | Non Singular String Literal Domain |
| #128 | Redis Object Cache | 28 | 151 | 103 | 400k+ | | | Exception output is not escaped |
| #129 | Post Types Order | 42 | 45 | 43 | 600k+ | | | wp function not compatible with requires wp |
| #130 | AMP | 43 | 63 | 362 | 400k+ | | | Non-prefixed hook name |
| #131 | Breeze Cache | 25 | 218 | 800 | 400k+ | | | Non-prefixed global variable |
| #132 | Converter for Media – Optimize images | Convert WebP & AVIF | 35 | 133 | 53 | 500k+ | | | curl curl setopt |
| #133 | Hello Dolly | 85 | 9 | 2 | 600k+ | | | Output is not escaped |
| #134 | Unlimited Elements For Elementor | 24 | 710 | 2,093 | 300k+ | | | Non-prefixed global variable |
| #135 | Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress | 24 | 2,581 | 2,109 | 100k+ | | | Output is not escaped |
| #136 | Image Optimization – Compress Images and Convert to WebP or AVIF | 87 | 15 | 24 | 1m+ | | | Missing Translators Comment |
| #137 | WPtouch – Make your WordPress Website Mobile-Friendly | 17 | 1,466 | 325 | 50k+ | | | Text Domain Mismatch |
| #138 | Translate WordPress with GTranslate | 32 | 82 | 364 | 900k+ | | | Non-prefixed global variable |
| #139 | Easy WP SMTP – WordPress SMTP and Email Logs: Gmail SMTP, Office 365, Outlook, Custom SMTP, and more | 15 | 45 | 166 | 500k+ | | | Database parameter is not escaped |
| #140 | Social Chat – Click To Chat App Button | 56 | 81 | 45 | 200k+ | | | Text Domain Mismatch |
| #141 | GTM4WP – A Google Tag Manager (GTM) plugin for WordPress | 91 | 59 | 79 | 700k+ | | | Non-prefixed global variable |
| #142 | Extendify | 35 | 80 | 64 | 500k+ | | | Text Domain Mismatch |
| #143 | Kirki – Freeform Page Builder, Website Builder & Customizer | 26 | 192 | 799 | 500k+ | | | Nonce verification recommended |
| #144 | Enable Media Replace | 24 | 212 | 276 | 600k+ | | | Output is not escaped |
| #145 | BuddyPress | 23 | 584 | 9,012 | 100k+ | | | Non-prefixed function |
| #146 | Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More | 27 | 165 | 430 | 100k+ | | | Non-prefixed global variable |
| #147 | Real Cookie Banner: GDPR & ePrivacy Cookie Consent | 30 | 9 | 496 | 100k+ | | | Database parameter is not escaped |
| #148 | Happy Addons for Elementor | 23 | 573 | 444 | 400k+ | | | Output is not escaped |
| #149 | SVG Support | 97 | 1 | 27 | 1m+ | | | Non-prefixed global variable |
| #150 | WP-PageNavi | 35 | 84 | 95 | 500k+ | | | Non Singular String Literal Domain |