| #9401 | WP Server Health Stats | 39 | 66 | 31 | 10k+ | | | Output is not escaped |
| #9402 | WP-ServerInfo | 38 | 162 | 55 | 10k+ | | | Output is not escaped |
| #9403 | WP Offload SES Lite | 96 | 541 | 5 | 10k+ | | | Text Domain Mismatch |
| #9404 | WP Session Manager | 91 | 5 | 16 | 2k+ | | | Direct Query |
| #9405 | Social Share Buttons & Analytics Plugin – GetSocial.io | 40 | 97 | 25 | 2k+ | | | Output is not escaped |
| #9406 | Bulk Edit YOAST SEO fields in Spreadsheet | 61 | 56 | 16 | 1k+ | | | Non Singular String Literal Domain |
| #9407 | ShinyStat Widget | 72 | 14 | 2 | 800 | | | Output is not escaped |
| #9408 | External Store for Shopify | 38 | 97 | 33 | 2k+ | | | Output is not escaped |
| #9409 | WP Shortcode by MyThemeShop | 59 | 32 | 5 | 10k+ | | | Output is not escaped |
| #9410 | WP Show Posts | 36 | 107 | 102 | 70k+ | | | Output is not escaped |
| #9411 | WP Show Stats | 37 | 197 | 103 | 400 | | | Output is not escaped |
| #9412 | WP-ShowHide | 96 | 6 | 5 | 10k+ | | | trademarked term |
| #9413 | WP Simple Booking Calendar | 31 | 337 | 380 | 20k+ | | | Output is not escaped |
| #9414 | Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning | 23 | 1,118 | 202 | 40k+ | | | Missing Translators Comment |
| #9415 | WP Simple Mail Sender | 78 | 21 | 6 | 3k+ | | | Non Singular String Literal Domain |
| #9416 | Post View Count | 99 | 1 | 1 | 4k+ | | | outdated tested upto header |
| #9417 | WP Site Verification tool | 35 | 34 | 37 | 1k+ | | | Non-prefixed global variable |
| #9418 | WP Sitemap Control | 39 | 31 | 37 | 400 | | | Output is not escaped |
| #9419 | WP Sitemap Page | 49 | 43 | 14 | 200k+ | | | Missing Translators Comment |
| #9420 | WP Sitemaps Config | 39 | 88 | 37 | 700 | | | Output is not escaped |
| #9421 | WP-Slimbox2 Plugin | 39 | 77 | 19 | 3k+ | | | Unsafe printing function |
| #9422 | WP Smart Preloader | 68 | 27 | 10 | 5k+ | | | Output is not escaped |
| #9423 | WP SmartCrop | 43 | 43 | 12 | 4k+ | | | Output is not escaped |
| #9424 | WSMS (formerly WP SMS) – SMS & MMS Notifications with OTP and 2FA for WooCommerce | 24 | 91 | 1,725 | 7k+ | | | Non-prefixed hook name |
| #9425 | Solid Mail – SMTP email and logging made by SolidWP | 68 | 16 | 17 | 60k+ | | | Database parameter is not escaped |
| #9426 | Smush – Image Optimization, Compression, Lazy Load, WebP & CDN | 25 | 244 | 568 | 1m+ | | | Non-prefixed hook name |
| #9427 | WP Snow Effect | 98 | 5 | 4 | 1k+ | | | Missing direct file access protection |
| #9428 | Wp Social Login and Register Social Counter | 25 | 80 | 738 | 90k+ | | | Non-prefixed global variable |
| #9429 | WP Social Preview | 54 | 33 | 15 | 800 | | | Non Singular String Literal Domain |
| #9430 | WP Social Ninja – Embed Social Feeds, User Reviews & Chat Widgets | 80 | 26 | 18 | 30k+ | | | Missing direct file access protection |
| #9431 | WP Social Widget | 39 | 239 | 7 | 4k+ | | | Output is not escaped |
| #9432 | WP Socializer – Simple & Easy Social Media Share Icons | 36 | 214 | 51 | 10k+ | | | Output is not escaped |
| #9433 | WP Sort Order | 36 | 134 | 211 | 6k+ | | | Direct Query |
| #9434 | WP Spam Question Filter | 35 | 63 | 30 | 2k+ | | | Output is not escaped |
| #9435 | Special Text Boxes | 37 | 38 | 42 | 2k+ | | | Direct Query |
| #9436 | WP-Speech-Balloon | 90 | 5 | 10 | 400 | | | trademarked term |
| #9437 | WP Spell Check | 25 | | 4,425 | 2k+ | | | Direct Query |
| #9438 | Advanced All in One Admin Search by WP Spotlight | 42 | 25 | 25 | 900 | | | Missing Version |
| #9439 | Subresource Integrity (SRI) Manager | 35 | 26 | 94 | 900 | | | Request data is not unslashed |
| #9440 | WP SSL Redirect | 91 | 1 | 8 | 700 | | | trademarked term |
| #9441 | WP STAGING – WordPress Backup, Restore, Migration & Clone | 23 | 1,504 | 1,567 | 100k+ | | | Non-prefixed global variable |
| #9442 | WP-Stateless – Google Cloud Storage | 24 | 1,036 | 482 | 4k+ | | | Non Singular String Literal Domain |
| #9443 | WP-Stateless – Gravity Forms Addon | 97 | 2 | 9 | 400 | | | Non-prefixed hook name |
| #9444 | WP Statistics – Simple, privacy-friendly Google Analytics alternative | 25 | 610 | 2,465 | 600k+ | | | Non-prefixed global variable |
| #9445 | WP-Stats | 32 | 237 | 126 | 2k+ | | | Output is not escaped |
| #9446 | WP Visitor Statistics (Real Time Traffic) | 31 | 353 | 691 | 20k+ | | | Nonce verification recommended |
| #9447 | WP Store Locator | 35 | 26 | 14 | 50k+ | | | wp function not compatible with requires wp |
| #9448 | WP Strip Image Metadata | 99 | 2 | 3 | 800 | | | trademarked term |
| #9449 | WP Stripe Checkout | 36 | 198 | 118 | 1k+ | | | Unsafe printing function |
| #9450 | WP Subscribe | 29 | 79 | 79 | 7k+ | | | Non-prefixed class |