| #201 | Header Footer Code Manager | 36 | 81 | 180 | 600k+ | | | Non-prefixed global variable |
| #202 | WP Popular Posts | 29 | 77 | 300 | 100k+ | | | Non-prefixed global variable |
| #203 | Flamingo | 40 | 15 | 228 | 800k+ | | | Nonce verification recommended |
| #204 | Embed Plus for YouTube Gallery, Livestream and Lazy Loading with Facades | 34 | 571 | 195 | 100k+ | | | Output is not escaped |
| #205 | Database Addon for Contact Form 7 – CFDB7 | 40 | 35 | 56 | 600k+ | | | Nonce verification recommended |
| #206 | Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization | 29 | 80 | 162 | 200k+ | | | Nonce verification recommended |
| #207 | Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels | 24 | 1,615 | 1,381 | 70k+ | | | Text Domain Mismatch |
| #208 | InfiniteWP Client | 22 | 2,286 | 1,812 | 200k+ | | | Exception output is not escaped |
| #209 | WP Migrate Lite – Migration Made Easy | 23 | 369 | 255 | 200k+ | | | Exception output is not escaped |
| #210 | Cart Abandonment Recovery for WooCommerce – Recover Lost Sales with Automated Emails | 26 | 51 | 325 | 300k+ | | | Direct Query |
| #211 | Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative) | 69 | 33 | 379 | 200k+ | | | Direct Query |
| #212 | Admin Menu Editor | 32 | 159 | 233 | 300k+ | | | Non-prefixed global variable |
| #213 | WP Multibyte Patch | 39 | 24 | 55 | 1m+ | | | Input is not sanitized |
| #214 | YARPP – Yet Another Related Posts Plugin | 27 | 191 | 331 | 100k+ | | | Non-prefixed global variable |
| #215 | Easy Updates Manager | 48 | 13 | 182 | 300k+ | | | Non-prefixed global variable |
| #216 | Relevanssi – A Better Search | 32 | 86 | 266 | 100k+ | | | Missing direct file access protection |
| #217 | WP Crontrol | 41 | 20 | 91 | 300k+ | | | Nonce verification recommended |
| #218 | LoginPress | wp-login Custom Login Page Customizer | 55 | 125 | 308 | 200k+ | | | Non-prefixed function |
| #219 | Anti-Malware Security and Brute-Force Firewall | 23 | 543 | 965 | 100k+ | | | Output is not escaped |
| #220 | Nextend Social Login and Register | 27 | 1,668 | 243 | 200k+ | | | Output is not escaped |
| #221 | Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More | 92 | 17 | 65 | 100k+ | | | Non-prefixed global variable |
| #222 | Firelight Lightbox | 51 | 78 | 97 | 200k+ | | | Non-prefixed global variable |
| #223 | Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI | 23 | 395 | 1,342 | 90k+ | | | Non-prefixed global variable |
| #224 | Schema & Structured Data for WP & AMP | 33 | 63 | 246 | 100k+ | | | Non-prefixed global variable |
| #225 | Customer Reviews for WooCommerce | 24 | 2,202 | 2,445 | 80k+ | | | Output is not escaped |
| #226 | Advanced Access Manager – Access Governance for WordPress | 32 | 849 | 62 | 100k+ | | | Output is not escaped |
| #227 | Members – Membership & User Role Editor Plugin | 32 | 233 | 259 | 300k+ | | | Output is not escaped |
| #228 | Event Tickets and Registration | 24 | 3,409 | 4,217 | 90k+ | | | Non-prefixed global variable |
| #229 | AI Agent by SiteGround | 54 | 28 | 6 | 1m+ | | | Exception output is not escaped |
| #230 | NextScripts: Social Networks Auto-Poster | 22 | 2,408 | 1,133 | 30k+ | | | Output is not escaped |
| #231 | Classic Widgets | 97 | 2 | 3 | 2m+ | | | outdated tested upto header |
| #232 | Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content | 25 | 681 | 1,513 | 300k+ | | | Non-prefixed global variable |
| #233 | Brevo – Email, SMS, Web Push, Chat, and more. | 20 | 460 | 646 | 100k+ | | | Request data is not unslashed |
| #234 | Use Any Font | Custom Font Uploader | 39 | 36 | 55 | 200k+ | | | Request data is not unslashed |
| #235 | Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty | 26 | 113 | 671 | 400k+ | | | Non-prefixed global variable |
| #236 | Rich Showcase for Google Reviews | 33 | 213 | 278 | 100k+ | | | Output is not escaped |
| #237 | Featured Image from URL (FIFU) | 24 | 1,654 | 418 | 70k+ | | | Non Singular String Literal Domain |
| #238 | SlimStat Analytics | 25 | 1,177 | 870 | 70k+ | | | Exception output is not escaped |
| #239 | Child Theme Configurator | 32 | 442 | 267 | 300k+ | | | Unsafe printing function |
| #240 | Call Now Button – The #1 Click to Call Button for WordPress | 37 | 1,273 | 5 | 200k+ | | | Exception output is not escaped |
| #241 | AI Engine – The Chatbot, AI Framework & MCP for WordPress | 23 | 408 | 539 | 100k+ | | | error log error log |
| #242 | Cookiebot by Usercentrics – Automatic Cookie Banner for GDPR/CCPA & Google Consent Mode | 49 | 148 | 176 | 100k+ | | | Non-prefixed global variable |
| #243 | Download Monitor | 19 | 424 | 1,362 | 80k+ | | | Non-prefixed hook name |
| #244 | Social Sharing Plugin – Sassy Social Share | 22 | 1,689 | 233 | 100k+ | | | wp function not compatible with requires wp |
| #245 | SiteGuard WP Plugin | 24 | 359 | 350 | 500k+ | | | Output is not escaped |
| #246 | Conditional Fields for Contact Form 7 | 41 | 106 | 53 | 100k+ | | | Output is not escaped |
| #247 | Modula Image Gallery – Photo Grid & Video Gallery | 22 | 474 | 436 | 100k+ | | | Text Domain Mismatch |
| #248 | Brizy – Page Builder | 20 | 589 | 720 | 70k+ | | | Output is not escaped |
| #249 | FileBird – WordPress Media Library Folders & File Manager | 24 | 239 | 377 | 200k+ | | | wp function not compatible with requires wp |
| #250 | reCaptcha by BestWebSoft | 29 | 474 | 272 | 100k+ | | | Text Domain Mismatch |