| #5101 | Custom Front Page | 98 | 2 | 2 | 900 | | | Missing direct file access protection |
| #5102 | Hide from Search | 35 | 5 | 8 | 3k+ | | | Missing direct file access protection |
| #5103 | Image Refresh | 35 | 4 | 6 | 1k+ | | | Dynamic hook name |
| #5104 | morkva Liqpay Extended | 98 | 3 | 4 | 400 | | | Non-prefixed class |
| #5105 | morkva Plata by Mono Extended | 95 | 112 | 14 | 400 | | | Text Domain Mismatch |
| #5106 | MS Custom Login | 41 | 117 | 6 | 900 | | | Unsafe printing function |
| #5107 | 코드엠샵 마이사이트 – MSHOP MY SITE | 36 | 58 | 55 | 800 | | | Output is not escaped |
| #5108 | 코드엠샵 소셜톡 | 40 | 47 | 36 | 400 | | | Output is not escaped |
| #5109 | MStore API – Create Native Android & iOS Apps On The Cloud | 23 | 618 | 764 | 3k+ | | | SQL query is not prepared |
| #5110 | MT Addons for Elementor | 24 | 3,073 | 1,442 | 2k+ | | | Text Domain Mismatch |
| #5111 | Mu Manager – Manage mu-plugins like standard plugins | 80 | 21 | 18 | 800 | | | Missing Arg Domain |
| #5112 | Multi Device Switcher | 98 | 2 | 9 | 20k+ | | | Non-prefixed function |
| #5113 | Multi Image Metabox | 65 | 17 | 8 | 7k+ | | | Output is not escaped |
| #5114 | Xpro Slider For Beaver Builder – Lite | 70 | 147 | 13 | 500 | | | Text Domain Mismatch |
| #5115 | Multi Step Form | 34 | 277 | 136 | 9k+ | | | Output is not escaped |
| #5116 | Multibanco / MB Way / Payshop / Cofidis Pay (by LUSOPAY) for WooCommerce | 25 | 492 | 216 | 400 | | | Text Domain Mismatch |
| #5117 | Multibanco, MB WAY, Credit card, Apple Pay, Google Pay, Payshop, Cofidis Pay, and PIX (ifthenpay) for WooCommerce | 95 | | 86 | 8k+ | | | Non-prefixed function |
| #5118 | Multicons | 96 | 38 | 0 | 2k+ | | | wp function not compatible with requires wp |
| #5119 | Multifile Upload Field for Contact Form 7 | 73 | 41 | 7 | 5k+ | | | Text Domain Mismatch |
| #5120 | Multilanguage by BestWebSoft – WordPress Translation Plugin and Language Switcher | 27 | 465 | 345 | 3k+ | | | Text Domain Mismatch |
| #5121 | Multilevel Navigation Menu | 44 | 80 | 1 | 500 | | | Output is not escaped |
| #5122 | MultiLine Files for Contact Form 7 | 38 | 98 | 40 | 9k+ | | | Text Domain Mismatch |
| #5123 | Multilingual Contact Form 7 with Polylang | 39 | 50 | 30 | 9k+ | | | Text Domain Mismatch |
| #5124 | Multilingual Forms for Fluent Forms with WPML | 67 | 52 | 16 | 1k+ | | | Text Domain Mismatch |
| #5125 | MultiManager WP – Manage All Your WordPress Sites Easily | 91 | 28 | 11 | 1k+ | | | Missing Arg Domain |
| #5126 | MultiParcels Shipping For WooCommerce | 23 | 179 | 356 | 4k+ | | | Request data is not unslashed |
| #5127 | Multipart robots.txt editor | 70 | 19 | 8 | 1k+ | | | Output is not escaped |
| #5128 | Multiple Admin Email Addresses | 74 | 7 | 4 | 1k+ | | | Missing nonce verification |
| #5129 | Multiple Domain | 41 | 42 | 17 | 10k+ | | | Output is not escaped |
| #5130 | Multiple Domain Mapping on Single Site | 38 | 135 | 51 | 6k+ | | | Text Domain Mismatch |
| #5131 | Multiple external product URLs for WooCommerce | 53 | 28 | 17 | 400 | | | Text Domain Mismatch |
| #5132 | Multiple Featured Images | 40 | 50 | 22 | 5k+ | | | Output is not escaped |
| #5133 | Multiple Form Instances Add-on for Gravity Forms | 82 | 5 | 5 | 800 | | | Missing direct file access protection |
| #5134 | Multiple Packages for WooCommerce | 59 | 34 | 4 | 600 | | | Text Domain Mismatch |
| #5135 | MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO | 23 | 485 | 580 | 2k+ | | | Missing nonce verification |
| #5136 | Multiple Post Passwords | 61 | 13 | 15 | 2k+ | | | Output is not escaped |
| #5137 | Multiple Post Thumbnails | 53 | 25 | 18 | 20k+ | | | Output is not escaped |
| #5138 | Multiple Roles | 71 | 7 | 20 | 5k+ | | | Non-prefixed global variable |
| #5139 | Multiple Sidebars | 36 | 109 | 75 | 600 | | | Non Singular String Literal Domain |
| #5140 | MultiSafepay plugin for WooCommerce | 64 | 13 | 35 | 2k+ | | | Missing nonce verification |
| #5141 | Multisite Language Switcher | 98 | 4 | 21 | 4k+ | | | Dynamic hook name |
| #5142 | Musician's Pack for Elementor – Music Website Widgets & Templates | 24 | 1,725 | 228 | 500 | | | Text Domain Mismatch |
| #5143 | Music Player for Elementor – Audio Player & Podcast Player | 24 | 608 | 1,302 | 10k+ | | | Non-prefixed global variable |
| #5144 | Music Player for WooCommerce | 29 | 106 | 155 | 1k+ | | | Non-prefixed global variable |
| #5145 | MW WP Form | 27 | 334 | 219 | 200k+ | | | Output is not escaped |
| #5146 | MW WP Form reCAPTCHA | 65 | 11 | 14 | 2k+ | | | Input is not sanitized |
| #5147 | Social Proof Popups & Real-Time Notifications – Herd Effects | 39 | 5 | 181 | 1k+ | | | Non-prefixed global variable |
| #5148 | MWW Disclaimer Buttons | 48 | 21 | 16 | 400 | | | Output is not escaped |
| #5149 | MX Time Zone Clocks | 38 | 219 | 41 | 1k+ | | | Output is not escaped |
| #5150 | MxChat – AI Chatbot & Content Generation for WordPress | 24 | 3,220 | 1,399 | 2k+ | | | Text Domain Mismatch |