| #9201 | Lucky Wheel Giveaway | 96 | 3 | 27 | 500 | | | Non-prefixed constant |
| #9202 | WP Magazine Modules Lite | 29 | 152 | 674 | 5k+ | | | Non-prefixed global variable |
| #9203 | WP Mail | 36 | 202 | 201 | 500 | | | Output is not escaped |
| #9204 | Mail logging – WP Mail Catcher | 35 | 232 | 157 | 20k+ | | | Text Domain Mismatch |
| #9205 | WP Mail Logging | 34 | 76 | 258 | 300k+ | | | Nonce verification recommended |
| #9206 | wp_mail return-path | 96 | 4 | 4 | 5k+ | | | trademarked term |
| #9207 | WP SMTP Mailer – SMTP7 | 67 | 2 | 33 | 9k+ | | | Request data is not unslashed |
| #9208 | WP Mail SMTP SendGrid Edition | 38 | 102 | 19 | 500 | | | Text Domain Mismatch |
| #9209 | WP Mail From II | 82 | 3 | 7 | 5k+ | | | trademarked term |
| #9210 | WP Mailgun SMTP | 38 | 99 | 51 | 900 | | | Text Domain Mismatch |
| #9211 | WP Mailto Links – Protect Email Addresses | 35 | 95 | 69 | 8k+ | | | Output is not escaped |
| #9212 | WP Maintenance | 34 | 40 | 217 | 60k+ | | | Non-prefixed global variable |
| #9213 | LightStart – Maintenance Mode, Coming Soon and Landing Page Builder | 34 | 42 | 312 | 400k+ | | | Request data is not unslashed |
| #9214 | WP Maintenance Mode & Site Under Construction | 38 | 72 | 57 | 3k+ | | | Output is not escaped |
| #9215 | Malcure Malware Shield — Removal, Repair, Monitor | 99 | | 7 | 10k+ | | | upgrade notice limit |
| #9216 | WP Map Block – Gutenberg Map Block for Google Map and OpenStreet Map by aBlocks | 79 | 6 | 10 | 20k+ | | | trademarked term |
| #9217 | WP Mapa Politico España | 69 | 32 | 12 | 400 | | | Output is not escaped |
| #9218 | WP Mapbox GL JS Maps | 28 | 104 | 119 | 1k+ | | | Output is not escaped |
| #9219 | WP MapIt | 98 | 6 | 3 | 2k+ | | | wp function not compatible with requires wp |
| #9220 | WP-Markdown | 35 | 31 | 39 | 400 | | | Output is not escaped |
| #9221 | FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce | 23 | 941 | 2,179 | 20k+ | | | SQL query is not prepared |
| #9222 | WP Mautic | 92 | 3 | 5 | 6k+ | | | trademarked term |
| #9223 | WP Max Submit Protect | 65 | 19 | 12 | 400 | | | Output is not escaped |
| #9224 | WP Maximum Execution Time Exceeded | 97 | 4 | 3 | 20k+ | | | trademarked term |
| #9225 | EasyMedia – Increase Media Upload File Size | Role-Based Upload Limit | Increase Execution Time | 33 | 82 | 138 | 70k+ | | | Non-prefixed global variable |
| #9226 | WP Media Categories | 38 | 40 | 103 | 800 | | | Nonce verification recommended |
| #9227 | WP Media Category Management | 42 | 10 | 176 | 6k+ | | | Nonce verification recommended |
| #9228 | Rename WP Media Files Name | 99 | | 6 | 500 | | | Non-prefixed function |
| #9229 | WP Media folders | 41 | 19 | 74 | 3k+ | | | Direct Query |
| #9230 | Media Library Categories | 40 | 29 | 49 | 20k+ | | | Output is not escaped |
| #9231 | WP Mega Menu | 23 | 992 | 792 | 8k+ | | | Non-prefixed global variable |
| #9232 | WP-Members Membership Plugin | 24 | 669 | 382 | 50k+ | | | Output is not escaped |
| #9233 | WP-Memory-Usage | 89 | 4 | 9 | 10k+ | | | Interpolated SQL is not prepared |
| #9234 | WP Menu Custom Fields | 35 | 11 | 6 | 600 | | | Hidden files included |
| #9235 | WP Menu Icons | 54 | 68 | 52 | 20k+ | | | Text Domain Mismatch |
| #9236 | WP Menu Image | 98 | 2 | 4 | 2k+ | | | trademarked term |
| #9237 | WP Meta and Date Remover | 24 | 665 | 1,314 | 90k+ | | | Non-prefixed global variable |
| #9238 | MDTF – Meta Data and Taxonomies Filter | 16 | 1,550 | 1,956 | 1k+ | | | Non-prefixed global variable |
| #9239 | WP Meteor Website Speed Optimization Addon | 40 | 34 | 19 | 20k+ | | | Output is not escaped |
| #9240 | WP Migrate Lite – Migration Made Easy | 23 | 369 | 255 | 200k+ | | | Exception output is not escaped |
| #9241 | WebToffee WP Backup and Migration | 33 | 132 | 222 | 5k+ | | | Non-prefixed global variable |
| #9242 | mb.miniAudioPlayer – an HTML5 audio player for your mp3 files | 38 | 204 | 6 | 4k+ | | | Unsafe printing function |
| #9243 | WP Minify Fix | 20 | 306 | 380 | 800 | | | Output is not escaped |
| #9244 | WP Missed Schedule Posts | 87 | 7 | 9 | 10k+ | | | trademarked term |
| #9245 | WP Mobile Detect | 91 | 4 | 6 | 5k+ | | | trademarked term |
| #9246 | WP Modal Popup with Cookie Integration | 41 | 88 | 13 | 1k+ | | | Unsafe printing function |
| #9247 | wp-Monalisa | 48 | 56 | 94 | 700 | | | Direct Query |
| #9248 | WP Most Popular | 39 | 50 | 35 | 2k+ | | | Output is not escaped |
| #9249 | wp-mpdf | 27 | 123 | 382 | 1k+ | | | Non-prefixed global variable |
| #9250 | Multi-Step Checkout for WooCommerce | 71 | 38 | 104 | 8k+ | | | Non-prefixed global variable |