| #2451 | Customize Twenty Sixteen | 75 | 32 | 11 | 500 | | | Text Domain Mismatch |
| #2452 | Style Contact Form 7 | 100 | | 1 | 1k+ | | | Discouraged text-domain loading |
| #2453 | Customizer Custom CSS | 92 | 5 | 2 | 400 | | | Deprecated parameter: load_plugin_textdomain parameter 2 |
| #2454 | Disable Customizer | 92 | 3 | 1 | 400 | | | Output is not escaped |
| #2455 | Customizer Export/Import | 47 | 14 | 15 | 100k+ | | | Unsafe printing function |
| #2456 | Login Page Customizer – Customize Login Screen & Branding | 38 | 36 | 172 | 1k+ | | | Non-prefixed function |
| #2457 | Customizer Reset – Export & Import | 88 | 6 | 9 | 900 | | | wp function not compatible with requires wp |
| #2458 | Customizer Backup & Reset | 35 | 8 | 10 | 7k+ | | | Output is not escaped |
| #2459 | Customizer Search | 87 | 10 | 1 | 50k+ | | | Missing direct file access protection |
| #2460 | CV Demo Importer | 64 | 21 | 95 | 400 | | | Non-prefixed global variable |
| #2461 | AOS Animation for SiteOrigin Page Builder | 97 | 2 | 7 | 3k+ | | | Missing Version |
| #2462 | Simpliest Social Share | 42 | 37 | 22 | 600 | | | Unsafe printing function |
| #2463 | WebDefender Security – Protection & AntiSpam | 70 | 176 | 61 | 1k+ | | | wp function not compatible with requires wp |
| #2464 | CWW Companion | 23 | 307 | 223 | 1k+ | | | Output is not escaped |
| #2465 | CWW connector Lite – Connect Contact Form 7 & ActiveCampaign | 42 | 39 | 21 | 400 | | | Output is not escaped |
| #2466 | Cyberpret – Calculettes | 44 | 41 | 17 | 500 | | | Output is not escaped |
| #2467 | Cyclone Demo Importer | 26 | 1,778 | 448 | 10k+ | | | Text Domain Mismatch |
| #2468 | Cyr to Lat Reloaded – Transliteration of Links and File Names | 65 | 13 | 36 | 30k+ | | | Direct Query |
| #2469 | Cyr-To-Lat | 54 | 16 | 48 | 300k+ | | | Dynamic hook name |
| #2470 | Cyr to Lat Enhanced | 99 | 2 | 0 | 80k+ | | | five star reviews detected |
| #2471 | Cyrlitera – Transliteration of Links and File Names | 27 | 453 | 204 | 40k+ | | | Output is not escaped |
| #2472 | Da Reactions | 39 | 15 | 140 | 400 | | | Request data is not unslashed |
| #2473 | TinyMCE Recover | 96 | 5 | 1 | 600 | | | Missing direct file access protection |
| #2474 | «Подсказки» от DaData.ru | 90 | 5 | 5 | 700 | | | Not In Footer |
| #2475 | Daddy Plus | 90 | 35 | 552 | 8k+ | | | Non-prefixed global variable |
| #2476 | Dadevarzan Beaver Builder Modules | 63 | 167 | 5 | 600 | | | Text Domain Mismatch |
| #2477 | Dadevarzan WordPress Common | 35 | 56 | 71 | 700 | | | Text Domain Mismatch |
| #2478 | Autolinks Manager – SEO Auto Linker | 87 | 7 | 16 | 1k+ | | | Database parameter is not escaped |
| #2479 | Helpful – Article Feedback Plugin | 86 | 8 | 17 | 600 | | | Database parameter is not escaped |
| #2480 | Interlinks Manager – Internal Links Optimizer | 80 | 17 | 13 | 7k+ | | | Database parameter is not escaped |
| #2481 | OpenID Connect Generic Client | 73 | 9 | 59 | 10k+ | | | Non-prefixed hook name |
| #2482 | Daily Prayer Time | 21 | 947 | 1,780 | 1k+ | | | Non-prefixed global variable |
| #2483 | Daisy Comments — Disable Comments & Stop Spam | 95 | 1 | 3 | 1k+ | | | Non-prefixed class |
| #2484 | Daisy Titles — Style & Hide Page and Post Titles | 92 | 1 | 5 | 3k+ | | | Discouraged text-domain loading |
| #2485 | Daisycon prijsvergelijkers | 99 | | 13 | 400 | | | Non-prefixed class |
| #2486 | Dam Spam | 100 | | 1 | 2k+ | | | unexpected markdown file |
| #2487 | Markdown Editor (Formerly Dark Mode) | 97 | 2 | 19 | 1k+ | | | Non-prefixed function |
| #2488 | Dark Mode Toggle | 100 | | 0 | 2k+ | | | No open findings |
| #2489 | Known Agents – Track AI Bots and Crawlers, Block Scrapers, Analyze LLM Referral Traffic | 57 | 37 | 12 | 1k+ | | | Setting is missing a sanitization callback |
| #2490 | Darkify – Dark Mode & Night Mode for Website & Admin (Dark Theme Included) | 38 | 38 | 183 | 600 | | | Non-prefixed global variable |
| #2491 | DarkLooks – Dark Mode Switcher For WordPress | 35 | 195 | 21 | 900 | | | Text Domain Mismatch |
| #2492 | Darklup – Enhanced WordPress Dark Mode, Dark Theme, Night Mode & Accessibility Plugin | 28 | 639 | 85 | 1k+ | | | Text Domain Mismatch |
| #2493 | DarkMySite – Advanced Dark Mode Plugin for WordPress | 46 | 22 | 100 | 1k+ | | | Request data is not unslashed |
| #2494 | Dash Notifier | 73 | 12 | 6 | 20k+ | | | Heredoc Output Not Escaped |
| #2495 | Dashboard Columns | 98 | 2 | 6 | 1k+ | | | Non-prefixed function |
| #2496 | Dashboard Commander | 69 | 13 | 2 | 900 | | | Output is not escaped |
| #2497 | Dashboard Directory Size | 65 | 32 | 9 | 400 | | | Missing Arg Domain |
| #2498 | Dashboard Notepad | 41 | 29 | 34 | 10k+ | | | Missing nonce verification |
| #2499 | Dashboard Notes | 42 | 27 | 34 | 600 | | | Missing Arg Domain |
| #2500 | Dashboard quick links widget | 49 | 22 | 16 | 600 | | | Output is not escaped |