| #1951 | Shortcode Redirect | 100 | 1 | 0 | 10k+ | | | Missing direct file access protection |
| #1952 | Shortcake (Shortcode UI) | 35 | 9 | 39 | 10k+ | | | Request data is not unslashed |
| #1953 | Shortcode Widget | 100 | | 0 | 10k+ | | | No open findings |
| #1954 | Shortcodes for Divi | 98 | 2 | 3 | 10k+ | | | Discouraged text-domain loading |
| #1955 | Show/Hide Content at Set Time | 35 | 17 | 7 | 10k+ | | | date date |
| #1956 | ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization | 24 | 926 | 322 | 10k+ | | | Output is not escaped |
| #1957 | Show-Hide / Collapse-Expand | 70 | 18 | 15 | 10k+ | | | Missing direct file access protection |
| #1958 | Show Pages IDs | 74 | 8 | 8 | 10k+ | | | Output is not escaped |
| #1959 | Sidebar Login | 97 | 2 | 6 | 10k+ | | | Non-prefixed global variable |
| #1960 | Simple Admin Language Change | 98 | 4 | 2 | 10k+ | | | Missing direct file access protection |
| #1961 | Simple Divi Shortcode | 89 | 5 | 0 | 10k+ | | | Output is not escaped |
| #1962 | Code Embed | 100 | | 0 | 10k+ | | | No open findings |
| #1963 | Simple Like Page – Fast & Privacy-Friendly Page Embeds | 41 | 145 | 31 | 10k+ | | | Output is not escaped |
| #1964 | Simple Floating Menu | 76 | 13 | 3 | 10k+ | | | Missing direct file access protection |
| #1965 | Simple Full Screen Background Image | 44 | 23 | 13 | 10k+ | | | Output is not escaped |
| #1966 | Simple Image Widget | 44 | 26 | 19 | 10k+ | | | Unsafe printing function |
| #1967 | Simple Job Board | 22 | 634 | 1,355 | 10k+ | | | Non-prefixed global variable |
| #1968 | Simple Login Captcha | 70 | 20 | 19 | 10k+ | | | date date |
| #1969 | Simple Map | 35 | 10 | 1 | 10k+ | | | Output is not escaped |
| #1970 | Simple Membership After Login Redirection | 63 | 4 | 24 | 10k+ | | | Missing nonce verification |
| #1971 | Simple Page Redirect | 81 | 3 | 7 | 10k+ | | | Request data is not unslashed |
| #1972 | Simple Revisions Delete | 43 | 16 | 26 | 10k+ | | | Output is not escaped |
| #1973 | Simple Side Tab | 43 | 28 | 17 | 10k+ | | | Unsafe printing function |
| #1974 | Simple Taxonomy Ordering | 75 | 7 | 10 | 10k+ | | | Direct Query |
| #1975 | SimpleTOC – Table of Contents Block | 35 | 10 | 0 | 10k+ | | | Setting is missing a sanitization callback |
| #1976 | Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads | 77 | 17 | 1 | 10k+ | | | Exception output is not escaped |
| #1977 | Affiliate Program Suite — SliceWP Affiliates | 25 | 1,291 | 2,089 | 10k+ | | | Output is not escaped |
| #1978 | Slider by 10Web – Responsive Image Slider | 23 | 5,814 | 976 | 10k+ | | | Output is not escaped |
| #1979 | Slim Maintenance Mode | 68 | 9 | 10 | 10k+ | | | Output is not escaped |
| #1980 | Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management | 25 | 367 | 923 | 10k+ | | | SQL query is not prepared |
| #1981 | SMK Sidebar Generator | 64 | 19 | 5 | 10k+ | | | Output is not escaped |
| #1982 | Social Icons | 38 | 72 | 83 | 10k+ | | | Output is not escaped |
| #1983 | Social Media Feather | 99 | | 4 | 10k+ | | | Non-prefixed constant |
| #1984 | Widgets for Social Photo Feed | 91 | 1 | 147 | 10k+ | | | Non-prefixed global variable |
| #1985 | Social Snap — Social Share Buttons & Click to Tweet | 38 | 6 | 169 | 10k+ | | | Direct Query |
| #1986 | Softaculous | 24 | 115 | 50 | 10k+ | | | file system operations fread |
| #1987 | Solace Extra | 99 | | 5 | 10k+ | | | Non-prefixed class |
| #1988 | Soro – SEO Autopilot & AI Content Writer | 83 | 4 | 10 | 10k+ | | | Input is not sanitized |
| #1989 | Soumettre.fr | 39 | 130 | 26 | 10k+ | | | Text Domain Mismatch |
| #1990 | Spectra Blocks – AI Website Builder for the Block Editor | 35 | 241 | 1,276 | 10k+ | | | Non-prefixed global variable |
| #1991 | SportsPress – Sports Club & League Manager | 23 | 459 | 2,246 | 10k+ | | | Non-prefixed global variable |
| #1992 | SQLite Object Cache | 99 | 6 | 2 | 10k+ | | | wp function not compatible with requires wp |
| #1993 | SSH SFTP Updater Support | 79 | 6 | 31 | 10k+ | | | Non-prefixed global variable |
| #1994 | SSL Zen — SSL Certificate Installer & HTTPS Redirects | 22 | 751 | 1,605 | 10k+ | | | Non-prefixed global variable |
| #1995 | Starbox – the Author Box for Humans | 52 | 144 | 19 | 10k+ | | | Non Singular String Literal Domain |
| #1996 | Sticky Buttons – Floating Buttons Builder | 97 | 2 | 108 | 10k+ | | | Non-prefixed global variable |
| #1997 | Sticky Chat Widget – Floating Chat Icons, Contact Form, Call, Click to Chat, Email & Message Buttons | 35 | 33 | 293 | 10k+ | | | Non-prefixed global variable |
| #1998 | Oceanwp sticky header | 64 | 8 | 13 | 10k+ | | | Missing nonce verification |
| #1999 | Sticky Side Buttons | 64 | 27 | 4 | 10k+ | | | Unsafe printing function |
| #2000 | Stop WP Emails Going to Spam | 99 | 1 | 3 | 10k+ | | | trademarked term |