| #1001 | Manago AI & Leadoo AI | 23 | 644 | 429 | 1k+ | | | Unsafe printing function |
| #1002 | Terms and Conditions Popup for WooCommerce | 24 | 633 | 438 | 1k+ | | | Text Domain Mismatch |
| #1003 | ManageWP Worker | 23 | 506 | 565 | 1m+ | | | Non-prefixed class |
| #1004 | AI Product Tools – Bulk Product Content Generator & AI Toolkit for WooCommerce | 30 | 508 | 562 | 500 | | | SQL query is not prepared |
| #1005 | WPCOM Member | 26 | 432 | 638 | 1k+ | | | Non Singular String Literal Domain |
| #1006 | MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO | 23 | 485 | 580 | 2k+ | | | Missing nonce verification |
| #1007 | InstaWP Connect – 1-click WP Staging & Migration | 24 | 253 | 811 | 40k+ | | | Non-prefixed global variable |
| #1008 | Min and Max Quantity for WooCommerce | 24 | 603 | 459 | 20k+ | | | Text Domain Mismatch |
| #1009 | GG Woo Feed for WooCommerce Shopping Feed on Google and Other Channels | 24 | 469 | 592 | 1k+ | | | Non-prefixed global variable |
| #1010 | SiteOrigin Widgets Bundle | 24 | 605 | 455 | 400k+ | | | Output is not escaped |
| #1011 | The Innovative Form Builder – IvyForms | 22 | 750 | 309 | 600 | | | Exception output is not escaped |
| #1012 | Groundhogg — CRM, Newsletters, and Marketing Automation | 23 | 136 | 921 | 2k+ | | | Non-prefixed global variable |
| #1013 | Paytium: Mollie payment forms & donations | 26 | 506 | 551 | 3k+ | | | Unsafe printing function |
| #1014 | Issues and Series for Newspapers, Magazines, Publishers, Writers | 23 | 346 | 710 | 2k+ | | | Nonce verification recommended |
| #1015 | Shipment Tracker for Woocommerce | 23 | 477 | 576 | 2k+ | | | Missing Arg Domain |
| #1016 | WP Booking System – Booking Calendar | 28 | 502 | 549 | 20k+ | | | Output is not escaped |
| #1017 | WP-Members Membership Plugin | 24 | 669 | 382 | 50k+ | | | Output is not escaped |
| #1018 | StylePress for Elementor | 27 | 767 | 283 | 600 | | | Text Domain Mismatch |
| #1019 | Product Table For WooCommerce | 26 | 191 | 858 | 600 | | | Non-prefixed global variable |
| #1020 | Profile Extra Fields by BestWebSoft | 26 | 514 | 532 | 2k+ | | | Text Domain Mismatch |
| #1021 | Ditty – Responsive News Tickers, Sliders, and Lists | 26 | 561 | 484 | 30k+ | | | Output is not escaped |
| #1022 | WP Visitor Statistics (Real Time Traffic) | 31 | 353 | 691 | 20k+ | | | Nonce verification recommended |
| #1023 | Echo Knowledge Base – Documentation, FAQs, Chat & Smart Search | 27 | 289 | 751 | 10k+ | | | Output is not escaped |
| #1024 | SNS Count Cache | 22 | 918 | 120 | 8k+ | | | Non Singular String Literal Domain |
| #1025 | My Private Site – Make Your Whole Site Private, Force Login & Block Registration Spam | 27 | 713 | 321 | 10k+ | | | Text Domain Mismatch |
| #1026 | MaxButtons – Create buttons | 25 | 626 | 404 | 70k+ | | | Output is not escaped |
| #1027 | پلاگین پرداخت دلخواه | 20 | 584 | 446 | 900 | | | Text Domain Mismatch |
| #1028 | Interactive World Map | 29 | 684 | 341 | 1k+ | | | Text Domain Mismatch |
| #1029 | Secure Downloads | 28 | 616 | 406 | 600 | | | Output is not escaped |
| #1030 | The Moneytizer | 22 | 751 | 271 | 1k+ | | | Text Domain Mismatch |
| #1031 | WP Admin UI Customize | 30 | 629 | 390 | 30k+ | | | Non-prefixed global variable |
| #1032 | Breeze Cache | 25 | 218 | 800 | 400k+ | | | Non-prefixed global variable |
| #1033 | WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms | 28 | 659 | 359 | 400 | | | Text Domain Mismatch |
| #1034 | Advanced Sermons | 38 | 833 | 184 | 1k+ | | | Unsafe printing function |
| #1035 | Happy Addons for Elementor | 23 | 573 | 444 | 400k+ | | | Output is not escaped |
| #1036 | Dynamic Copyright Year | 36 | 972 | 43 | 800 | | | Output is not escaped |
| #1037 | TI WooCommerce Wishlist | 24 | 467 | 546 | 100k+ | | | Output is not escaped |
| #1038 | Product Import Export for WooCommerce – Import Export Product CSV Suite | 64 | 246 | 766 | 80k+ | | | Non-prefixed global variable |
| #1039 | FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) | 26 | 594 | 417 | 2k+ | | | Exception output is not escaped |
| #1040 | Worth The Read | 23 | 873 | 138 | 3k+ | | | Text Domain Mismatch |
| #1041 | Geo Mashup | 28 | 775 | 232 | 1k+ | | | Text Domain Mismatch |
| #1042 | Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms | 28 | 649 | 357 | 9k+ | | | Text Domain Mismatch |
| #1043 | PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes | 24 | 421 | 583 | 10k+ | | | Missing Translators Comment |
| #1044 | Events Manager – OpenStreetMaps | 20 | 559 | 444 | 700 | | | Output is not escaped |
| #1045 | WFatture for WooCommerce Fattureincloud | 25 | 229 | 774 | 800 | | | Non-prefixed global variable |
| #1046 | PDF Invoices & Packing Slips for WooCommerce | 35 | 35 | 966 | 300k+ | | | Non-prefixed hook name |
| #1047 | SEO Redirection Plugin – 301 Redirect Manager | 23 | 272 | 727 | 10k+ | | | Non-prefixed global variable |
| #1048 | WP 2FA – Two-factor authentication for WordPress | 25 | 283 | 716 | 100k+ | | | Non-prefixed global variable |
| #1049 | Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker | 31 | 63 | 935 | 6k+ | | | Interpolated SQL is not prepared |
| #1050 | rtMedia for WordPress, BuddyPress and bbPress | 21 | 363 | 633 | 8k+ | | | Non-prefixed constant |