| #1601 | Better WordPress External Links | 39 | 130 | 35 | 400 | | | Non Singular String Literal Domain |
| #1602 | Better WordPress Minify | 22 | 412 | 484 | 8k+ | | | Non Singular String Literal Domain |
| #1603 | Better WordPress Recent Comments | 36 | 319 | 69 | 600 | | | Text Domain Mismatch |
| #1604 | Analytics by BestWebSoft – Google Analytics Dashboard and Statistic Plugin for WordPress | 49 | 478 | 176 | 1k+ | | | Text Domain Mismatch |
| #1605 | BestWebSoft’s Pinterest | 57 | 490 | 176 | 500 | | | Text Domain Mismatch |
| #1606 | SMTP by BestWebSoft | 56 | 486 | 175 | 1k+ | | | Text Domain Mismatch |
| #1607 | bxSlider integration for WordPress | 48 | 126 | 21 | 500 | | | Text Domain Mismatch |
| #1608 | Delivery Date Time & Pickup for WooCommerce | 37 | 148 | 216 | 400 | | | Output is not escaped |
| #1609 | BZScore – Live Score | 94 | 5 | 3 | 600 | | | strip tags strip tags |
| #1610 | C3 Cloudfront Cache Controller | 35 | 109 | 60 | 3k+ | | | Non Singular String Literal Domain |
| #1611 | Cache Buster | 84 | 5 | 6 | 400 | | | Input is not sanitized |
| #1612 | Cache-Control | 57 | 26 | 4 | 1k+ | | | Output is not escaped |
| #1613 | Cache control by Cacholong | 41 | 87 | 30 | 500 | | | Non Singular String Literal Domain |
| #1614 | Cache Enabler | 35 | 44 | 75 | 90k+ | | | Input is not sanitized |
| #1615 | Cache External Scripts | 76 | 21 | 4 | 900 | | | Output is not escaped |
| #1616 | Cache Images | 39 | 72 | 27 | 1k+ | | | Unsafe printing function |
| #1617 | Cache Master | 34 | 371 | 27 | 400 | | | Output is not escaped |
| #1618 | Cache Using Gzip | 100 | | 0 | 400 | | | No open findings |
| #1619 | Cachebuster | 98 | 3 | 1 | 1k+ | | | Missing direct file access protection |
| #1620 | Cachify | 84 | 9 | 36 | 9k+ | | | Non-prefixed global variable |
| #1621 | Caddy – WooCommerce Side Cart & Free Shipping Bar | 67 | 38 | 199 | 3k+ | | | Non-prefixed global variable |
| #1622 | Cal.com | 99 | 1 | 0 | 1k+ | | | outdated tested upto header |
| #1623 | UseStrict's Calendly Embedder | 35 | 4 | 1 | 2k+ | | | Hidden files included |
| #1624 | Calculated fields for ACF | 66 | 5 | 18 | 1k+ | | | Non-prefixed global variable |
| #1625 | Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More | 24 | 344 | 609 | 40k+ | | | Non-prefixed global variable |
| #1626 | Calculation For Contact Form 7 | 74 | 21 | 5 | 1k+ | | | Text Domain Mismatch |
| #1627 | Calculator Builder – Create an Online Calculator | 39 | 16 | 221 | 1k+ | | | Non-prefixed global variable |
| #1628 | Cálculo do frete somente com o CEP – WC Brasil | 74 | 13 | 24 | 1k+ | | | Non-prefixed function |
| #1629 | Calendar | 99 | 1 | 3 | 4k+ | | | Non-prefixed constant |
| #1630 | Event Calendar – Calendar | 24 | 1,111 | 1,262 | 2k+ | | | Text Domain Mismatch |
| #1631 | Call Now and Chat Buttons | 72 | 13 | 2 | 5k+ | | | Setting is missing a sanitization callback |
| #1632 | Call Now Button – The #1 Click to Call Button for WordPress | 37 | 1,273 | 5 | 200k+ | | | Exception output is not escaped |
| #1633 | Call to Action Block by WPPOOL | 98 | 4 | 7 | 1k+ | | | trademarked term |
| #1634 | Call To Action Customizable Block | 99 | 1 | 3 | 1k+ | | | Non-prefixed function |
| #1635 | Social Chat Widget (⚡ by Callbell) | 71 | 11 | 6 | 600 | | | Output is not escaped |
| #1636 | Export/Import Media – CSV Media Library Import & Export | 98 | 7 | 4 | 1k+ | | | Missing Translators Comment |
| #1637 | Callout | 98 | 3 | 1 | 400 | | | Missing direct file access protection |
| #1638 | CallPage – Callback Widget | 49 | 41 | 17 | 1k+ | | | Non Singular String Literal Domain |
| #1639 | CallRail Phone Call Tracking | 69 | 11 | 12 | 10k+ | | | Input is not validated |
| #1640 | Campi Moduli Italiani | 34 | 72 | 363 | 500 | | | Unquoted Complex Placeholder |
| #1641 | Canada Post Shipping For WooCommerce | 92 | 4 | 0 | 2k+ | | | Output is not escaped |
| #1642 | PiWeb Cancel order / Refund request for WooCommerce | 76 | 40 | 49 | 2k+ | | | wp function not compatible with requires wp |
| #1643 | Candid Advanced Toolset | 97 | 10 | 2 | 1k+ | | | Missing direct file access protection |
| #1644 | Canonical Link | 99 | 1 | 0 | 2k+ | | | outdated tested upto header |
| #1645 | Canonical SEO | 98 | 2 | 0 | 6k+ | | | license mismatch |
| #1646 | Canonical SEO Content Syndication WordPress Plugin | 77 | 4 | 8 | 400 | | | Missing nonce verification |
| #1647 | Canvas Image Resize | 75 | 19 | 1 | 1k+ | | | Output is not escaped |
| #1648 | PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus | 25 | 362 | 1,586 | 100k+ | | | Non-prefixed global variable |
| #1649 | Captcha by BestWebSoft – Advanced Spam Protection, Math & OCR-Friendly Captcha for Site Forms | 22 | 493 | 295 | 10k+ | | | Text Domain Mismatch |
| #1650 | Captcha by Yandex for Contact Form 7 | 88 | 9 | 12 | 3k+ | | | Text Domain Mismatch |