| #3201 | WebberZone Top 10 — Popular Posts | 65 | 14 | 180 | 10k+ | | | Database parameter is not escaped |
| #3202 | YITH Proteo Toolkit | 54 | 130 | 64 | 1k+ | | | Text Domain Mismatch |
| #3203 | Avif Express | 35 | 26 | 167 | 400 | | | Input is not validated |
| #3204 | Kindeditor For WordPress | 31 | 63 | 130 | 500 | | | Non-prefixed global variable |
| #3205 | Media Sweep – WordPress Media Cleaner | 37 | 56 | 137 | 1k+ | | | Interpolated SQL is not prepared |
| #3206 | Podlove Subscribe button | 38 | 148 | 45 | 2k+ | | | Output is not escaped |
| #3207 | REST API Helper | 39 | 108 | 85 | 500 | | | Unsafe printing function |
| #3208 | Swifty Bar, sticky bar by WPGens | 37 | 112 | 81 | 400 | | | Output is not escaped |
| #3209 | WoowGallery | 60 | 15 | 178 | 1k+ | | | Non-prefixed global variable |
| #3210 | AidWP – Donation & Payment Forms (Stripe Powered) | 39 | | 193 | 800 | | | Non-prefixed global variable |
| #3211 | App Builder – Create Native Android & iOS Apps On The Flight | 33 | 73 | 119 | 600 | | | Text Domain Mismatch |
| #3212 | Aspexi Social Media Slider | 51 | 177 | 15 | 2k+ | | | Text Domain Mismatch |
| #3213 | Blackhole for Bad Bots | 39 | 123 | 69 | 30k+ | | | Output is not escaped |
| #3214 | Contact Form 7 – Post Fields | 38 | 167 | 25 | 3k+ | | | Text Domain Mismatch |
| #3215 | Comments Like Dislike | 41 | 172 | 20 | 5k+ | | | Non Singular String Literal Domain |
| #3216 | Image Editor by Pixo | 40 | 126 | 66 | 800 | | | Output is not escaped |
| #3217 | Italy Cookie Choices (for EU Cookie Law & Cookie Notice) | 36 | 115 | 77 | 10k+ | | | Unsafe printing function |
| #3218 | Post Ratings | 40 | 160 | 32 | 600 | | | Output is not escaped |
| #3219 | WP Hotel Booking WooCommerce | 36 | 93 | 99 | 1k+ | | | Output is not escaped |
| #3220 | Contact Form 7 Signature Addon | 45 | 147 | 44 | 6k+ | | | Text Domain Mismatch |
| #3221 | Expand Divi | 28 | 91 | 100 | 1k+ | | | Non-prefixed global variable |
| #3222 | Great Caroussel | 38 | 60 | 131 | 500 | | | SQL query is not prepared |
| #3223 | Image Widget Deluxe | 37 | 190 | 1 | 1k+ | | | Output is not escaped |
| #3224 | درگاه پرداخت بانک ملت ووکامرس | 28 | 61 | 130 | 2k+ | | | Request data is not unslashed |
| #3225 | News Manager | 36 | 134 | 57 | 600 | | | Output is not escaped |
| #3226 | Privilege Widget | 40 | 139 | 52 | 600 | | | Text Domain Mismatch |
| #3227 | Purchase Orders for WooCommerce | 43 | 117 | 74 | 1k+ | | | Text Domain Mismatch |
| #3228 | Repeater Fields for WPForms | 71 | 173 | 18 | 500 | | | wp function not compatible with requires wp |
| #3229 | Same Category Posts | 40 | 183 | 8 | 3k+ | | | Output is not escaped |
| #3230 | SEO Backlink Monitor | 43 | 86 | 105 | 700 | | | Output is not escaped |
| #3231 | Social Media Icons Widget | 72 | 181 | 10 | 1k+ | | | badly named files |
| #3232 | Floating Button – Easily Create Sticky, Fixed & Floating Buttons | 84 | 6 | 184 | 4k+ | | | Non-prefixed global variable |
| #3233 | Interactive US Map | 40 | 136 | 54 | 400 | | | Text Domain Mismatch |
| #3234 | involve.me – Create Surveys, Quizzes, Calculators & Forms as Embedded Widgets or Pop-ups | 39 | 158 | 32 | 400 | | | Text Domain Mismatch |
| #3235 | Track Geolocation Of Users Using Contact Form 7 | 40 | 17 | 173 | 900 | | | Nonce verification recommended |
| #3236 | Authors Widget | 35 | 170 | 19 | 1k+ | | | Output is not escaped |
| #3237 | Great Restaurant Menu WP | 81 | 89 | 100 | 1k+ | | | Text Domain Mismatch |
| #3238 | Custom API for WP | 59 | 173 | 16 | 1k+ | | | wp function not compatible with requires wp |
| #3239 | WeShareAI – AI-Powered Share Buttons (formerly E-MAILiT) | 39 | 165 | 24 | 700 | | | Unsafe printing function |
| #3240 | Juiz Last Tweet Widget | 32 | 136 | 53 | 500 | | | Output is not escaped |
| #3241 | Account Engagement | 32 | 115 | 74 | 2k+ | | | Output is not escaped |
| #3242 | Product Size Chart for Woocommerce | 39 | 20 | 169 | 600 | | | Non-prefixed global variable |
| #3243 | Shared Files – File Upload & Download Manager | 39 | 5 | 184 | 4k+ | | | Nonce verification recommended |
| #3244 | Spreadshop Plugin | 35 | 145 | 44 | 4k+ | | | wp function not compatible with requires wp |
| #3245 | Ultra Companion – Companion plugin for WPoperation Themes | 34 | 73 | 116 | 1k+ | | | Missing direct file access protection |
| #3246 | Additional Variation Images Gallery for WooCommerce | 40 | 60 | 129 | 20k+ | | | Non-prefixed global variable |
| #3247 | All-in-one Chat Button by anychat.one | 37 | 119 | 69 | 900 | | | Text Domain Mismatch |
| #3248 | Bellows Accordion Menu | 37 | 160 | 28 | 10k+ | | | Text Domain Mismatch |
| #3249 | GravityWP – Merge Tags | 59 | 16 | 172 | 2k+ | | | Non-prefixed global variable |
| #3250 | HandL UTM Grabber / Tracker | 37 | 36 | 152 | 10k+ | | | Missing nonce verification |