| #401 | Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder | 36 | 162 | 40 | 200k+ | | | Output is not escaped |
| #402 | Database Backup for WordPress | 35 | 128 | 88 | 70k+ | | | Output is not escaped |
| #403 | Custom Twitter Feeds – A Tweets Widget or X Feed Widget | 24 | 446 | 922 | 100k+ | | | Output is not escaped |
| #404 | Simple Calendar – Google Calendar Plugin | 24 | 2,053 | 592 | 50k+ | | | Missing direct file access protection |
| #405 | WP-Polls | 25 | 618 | 639 | 40k+ | | | Unsafe printing function |
| #406 | Quiz Maker by AYS | 25 | 505 | 3,027 | 20k+ | | | Non-prefixed global variable |
| #407 | WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters | 34 | 219 | 453 | 60k+ | | | wp function not compatible with requires wp |
| #408 | Popup Box – Create Countdown, Coupon, Video, Contact Form Popups | 24 | 482 | 1,253 | 50k+ | | | Non-prefixed global variable |
| #409 | Performance Lab | 99 | | 21 | 100k+ | | | Text Domain Mismatch |
| #410 | PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) | 35 | 6 | 56 | 80k+ | | | Post Not In exclude |
| #411 | Recent Posts Widget With Thumbnails | 37 | 222 | 46 | 100k+ | | | Output is not escaped |
| #412 | CAPTCHA 4WP – Antispam CAPTCHA solution for WordPress | 35 | 20 | 10 | 100k+ | | | Missing Arg Domain |
| #413 | Flexible Checkout Fields for WooCommerce – WooCommerce Checkout Manager | 35 | 64 | 64 | 80k+ | | | Non-prefixed global variable |
| #414 | Appointment Hour Booking – Booking Calendar | 25 | 262 | 1,253 | 10k+ | | | Non-prefixed global variable |
| #415 | Revive Social – Social Media Auto Post and Scheduling Automation Plugin | 21 | 256 | 431 | 20k+ | | | Non-prefixed hook name |
| #416 | reSmush.it : The original free image compressor and optimizer plugin | 25 | 155 | 69 | 100k+ | | | Output is not escaped |
| #417 | Fast Velocity Minify | 24 | 282 | 256 | 40k+ | | | Unsafe printing function |
| #418 | Table of Contents Plus | 95 | 29 | 9 | 200k+ | | | wp function not compatible with requires wp |
| #419 | GenerateBlocks | 97 | 9 | 8 | 200k+ | | | file system operations is writable |
| #420 | Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing | 35 | 50 | 236 | 50k+ | | | Non-prefixed hook name |
| #421 | Titan Anti-spam & Security – Brute Force Protection, 2FA & Spam Filter | 31 | 57 | 196 | 50k+ | | | Nonce verification recommended |
| #422 | The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid | 23 | 105 | 1,013 | 100k+ | | | Non-prefixed global variable |
| #423 | WP Hide & Security Enhancer | 27 | 124 | 375 | 50k+ | | | Input is not sanitized |
| #424 | Easy Social Feed – Social Photos Gallery and Post Feed for WordPress | 22 | 1,567 | 1,277 | 30k+ | | | Non-prefixed global variable |
| #425 | AI Powered Marketing | 89 | 8 | 8 | 50k+ | | | Offloaded Content |
| #426 | Clone | 23 | 244 | 262 | 40k+ | | | Output is not escaped |
| #427 | SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments | 19 | 528 | 1,119 | 80k+ | | | Non-prefixed global variable |
| #428 | Post Grid | 44 | 33 | 208 | 30k+ | | | Non-prefixed global variable |
| #429 | Tidio – Live Chat & AI Chatbots | 34 | 52 | 19 | 80k+ | | | curl curl setopt |
| #430 | Translate WordPress – Google Language Translator | 26 | 200 | 317 | 100k+ | | | Non-prefixed global variable |
| #431 | TermsFeed AutoTerms: Privacy Policy Generator, Cookie Consent, GDPR, CCPA, Terms & Conditions, Disclaimers, Cookies Policy, EULA | 24 | 939 | 161 | 70k+ | | | Non Singular String Literal Domain |
| #432 | Cyr-To-Lat | 54 | 16 | 48 | 300k+ | | | Dynamic hook name |
| #433 | WP Sitemap Page | 49 | 43 | 14 | 200k+ | | | Missing Translators Comment |
| #434 | Addon Elements for Elementor (formerly Elementor Addon Elements) | 27 | 4,065 | 103 | 90k+ | | | Text Domain Mismatch |
| #435 | WP Photo Album Plus | 25 | 4 | 1,807 | 10k+ | | | Direct Query |
| #436 | NinjaFirewall (WP Edition) – Advanced Security Plugin and Firewall | 22 | 1,272 | 2,063 | 100k+ | | | Non-prefixed global variable |
| #437 | YITH WooCommerce Ajax Search | 22 | 408 | 1,659 | 30k+ | | | Non-prefixed global variable |
| #438 | WP-PostViews | 35 | 132 | 64 | 100k+ | | | Unsafe printing function |
| #439 | WP RSS Aggregator – RSS Import, Feed to Post, Autoblogging, AI Content | 24 | 1,777 | 394 | 40k+ | | | Text Domain Mismatch |
| #440 | Shortcodes and extra features for Phlox theme | 23 | 412 | 424 | 90k+ | | | Output is not escaped |
| #441 | Simple Membership | 24 | 2,297 | 1,734 | 40k+ | | | Unsafe printing function |
| #442 | BBQ Firewall – Fast & Powerful Firewall Security | 44 | 17 | 17 | 100k+ | | | Output is not escaped |
| #443 | Easy Google Fonts | 90 | 12 | 26 | 100k+ | | | Non-prefixed hook name |
| #444 | Media File Renamer: Rename for better SEO (AI-Powered) | 26 | 154 | 170 | 40k+ | | | Direct Query |
| #445 | Adminimize | 29 | 296 | 691 | 200k+ | | | Non-prefixed global variable |
| #446 | WP Encryption – No.1 HTTPS plugin & One Click Free SSL Cert, HTTPS Redirect, SSL Security | 25 | 875 | 1,764 | 50k+ | | | Non-prefixed global variable |
| #447 | Direct Checkout for WooCommerce | 72 | 77 | 35 | 80k+ | | | Text Domain Mismatch |
| #448 | Site Reviews | 23 | 1,626 | 604 | 60k+ | | | Output is not escaped |
| #449 | Admin Columns | 25 | 613 | 995 | 100k+ | | | Non-prefixed namespace |
| #450 | Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker | 24 | 405 | 2,606 | 40k+ | | | Non-prefixed hook name |