| #3251 | Email Subscription Popup — Newsletter & GDPR Consent | 35 | 683 | 193 | 1k+ | | | Output is not escaped |
| #3252 | Swap Google Fonts Display: Improve Font Rendering & Performance | 99 | 1 | 1 | 10k+ | | | mismatched plugin name |
| #3253 | Mollie Forms | 41 | 14 | 565 | 3k+ | | | Request data is not unslashed |
| #3254 | Brozzme DB Prefix & Tools Addons | 35 | 24 | 42 | 10k+ | | | Request data is not unslashed |
| #3255 | Send Users Email – Email Subscribers, Email Marketing Newsletter | 26 | 188 | 415 | 5k+ | | | Non-prefixed global variable |
| #3256 | Current Year, Symbols and IP Shortcode | 96 | 76 | 0 | 10k+ | | | wp function not compatible with requires wp |
| #3257 | Pages with category and tag | 100 | | 0 | 60k+ | | | No open findings |
| #3258 | PiWeb Product Enquiry or product catalog for WooCommerce | 38 | 255 | 145 | 1k+ | | | Text Domain Mismatch |
| #3259 | Video Gallery by Huzzaz | 97 | 5 | 2 | 900 | | | Non Enqueued Script |
| #3260 | Ultimate Bootstrap Elements for Elementor | 25 | 6,326 | 122 | 6k+ | | | Text Domain Mismatch |
| #3261 | Spam Protect for Contact Form 7 | 41 | 16 | 61 | 10k+ | | | Request data is not unslashed |
| #3262 | Zotpress | 42 | 10 | 403 | 2k+ | | | Non-prefixed global variable |
| #3263 | Iks Menu – WordPress Category Accordion Menu & FAQs | 23 | 615 | 1,293 | 10k+ | | | Non-prefixed global variable |
| #3264 | PayTR Sanal POS WooCommerce – iFrame API | 36 | 117 | 54 | 10k+ | | | Output is not escaped |
| #3265 | Affiliates WooCommerce Light | 99 | 1 | 3 | 1k+ | | | trademarked term |
| #3266 | Image Hover Effects For WPBakery Page Builder | 98 | 30 | 4 | 3k+ | | | Missing Arg Domain |
| #3267 | Coupon & Discount Code Reveal Button | 89 | 37 | 10 | 1k+ | | | wp function not compatible with requires wp |
| #3268 | Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments | 23 | 121 | 1,227 | 2k+ | | | Non-prefixed global variable |
| #3269 | Bulk Page Generator and Mass Page Builder – Page Generator | 87 | 26 | 87 | 4k+ | | | Non-prefixed global variable |
| #3270 | Quick View for WooCommerce | 94 | | 163 | 2k+ | | | Non-prefixed global variable |
| #3271 | Hitsteps Web Analytics | 34 | 370 | 313 | 800 | | | Output is not escaped |
| #3272 | affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display | 34 | 326 | 75 | 2k+ | | | Output is not escaped |
| #3273 | Image Source Control Lite – Show Image Credits and Captions | 33 | 140 | 221 | 3k+ | | | Non-prefixed hook name |
| #3274 | Download After Email – Subscribe & Download Form Plugin | 34 | 22 | 356 | 7k+ | | | Input is not validated |
| #3275 | Category Editor | 43 | 54 | 18 | 8k+ | | | Unsafe printing function |
| #3276 | Praison AI SEO | 28 | 649 | 306 | 1k+ | | | Text Domain Mismatch |
| #3277 | WP BrowserUpdate | 90 | 11 | 7 | 1k+ | | | Missing Translators Comment |
| #3278 | Category Checklist Tree | 98 | 3 | 0 | 5k+ | | | Missing direct file access protection |
| #3279 | AutoConvert Greeklish Permalinks | 40 | 116 | 13 | 30k+ | | | Text Domain Mismatch |
| #3280 | Inavii Social Feed – Live Social Proof Gallery | 34 | 532 | 180 | 9k+ | | | Text Domain Mismatch |
| #3281 | QODE Wishlist for WooCommerce | 89 | 2 | 178 | 10k+ | | | Non-prefixed global variable |
| #3282 | UsersWP – Social Login | 37 | 299 | 91 | 2k+ | | | Text Domain Mismatch |
| #3283 | T4B News Ticker – Responsive News Scroller, Slider, and Animations | 65 | 20 | 10 | 7k+ | | | Output is not escaped |
| #3284 | WP Flow Plus | 37 | 175 | 146 | 800 | | | Output is not escaped |
| #3285 | Easy Timer | 33 | 78 | 450 | 1k+ | | | Non-prefixed global variable |
| #3286 | Ultimate WooCommerce Filters | 32 | 322 | 207 | 600 | | | Unsafe printing function |
| #3287 | WholesaleX – B2B & Wholesale Plugin for WooCommerce with Wholesale Prices | 38 | 33 | 181 | 2k+ | | | Non-prefixed global variable |
| #3288 | WC Cancel Order | 35 | 52 | 122 | 5k+ | | | Non-prefixed hook name |
| #3289 | Image Optimizer, Resizer and CDN – Sirv | 23 | 616 | 1,004 | 1k+ | | | Output is not escaped |
| #3290 | AI Bud – AI Content Generator, AI Chatbot, ChatGPT, Gemini, GPT-4o | 96 | 5 | 54 | 2k+ | | | Non-prefixed global variable |
| #3291 | Widgets for Social Photo Feed | 91 | 1 | 147 | 10k+ | | | Non-prefixed global variable |
| #3292 | OTP Login With Phone Number, OTP Verification | 92 | 3 | 23 | 900 | | | Non-prefixed hook name |
| #3293 | WP Mail Log | 43 | 40 | 29 | 10k+ | | | Text Domain Mismatch |
| #3294 | SuperFaktura WooCommerce | 36 | 60 | 116 | 2k+ | | | Nonce verification recommended |
| #3295 | CartPops – High Converting Add To Cart Popup For WooCommerce | 33 | 63 | 188 | 4k+ | | | Non-prefixed global variable |
| #3296 | VS Meta Description | 99 | 1 | 3 | 3k+ | | | Direct Query |
| #3297 | PeproDev Ultimate Invoice | 24 | 379 | 234 | 4k+ | | | Output is not escaped |
| #3298 | Restrict Widgets | 38 | 135 | 40 | 4k+ | | | Non Singular String Literal Domain |
| #3299 | Royal WordPress Backup, Restore & Migration Plugin – Backup WordPress Sites Safely | 53 | 34 | 90 | 20k+ | | | Database parameter is not escaped |
| #3300 | Auto Hide Admin Bar | 99 | 2 | 0 | 4k+ | | | Missing direct file access protection |