| #3901 | Meta pixel for WordPress | 35 | 90 | 40 | 400k+ | | | Exception output is not escaped |
| #3902 | Really Simple Google Tag Manager (GTM) | 35 | 115 | 15 | 4k+ | | | Text Domain Mismatch |
| #3903 | Sitekit | 35 | 122 | 8 | 3k+ | | | Output is not escaped |
| #3904 | Staffer | 42 | 88 | 42 | 600 | | | Output is not escaped |
| #3905 | ThemeRain Core | 35 | 69 | 61 | 1k+ | | | Text Domain Mismatch |
| #3906 | External Store for Shopify | 38 | 97 | 33 | 2k+ | | | Output is not escaped |
| #3907 | QuadLayers TikTok Feed | 47 | 78 | 52 | 7k+ | | | Text Domain Mismatch |
| #3908 | AutoConvert Greeklish Permalinks | 40 | 116 | 13 | 30k+ | | | Text Domain Mismatch |
| #3909 | Bulk Move | 40 | 85 | 44 | 9k+ | | | Unsafe printing function |
| #3910 | CookieAdmin – Cookie Consent Banner | 37 | 43 | 86 | 400k+ | | | Nonce verification recommended |
| #3911 | Custom CSS and JavaScript | 35 | 38 | 91 | 10k+ | | | Input is not sanitized |
| #3912 | Donation Block For PayPal | 37 | 23 | 106 | 600 | | | Input is not validated |
| #3913 | FluentAffiliate – Affiliate Program Management Suite, Affiliates Manager | 41 | 115 | 14 | 1k+ | | | Exception output is not escaped |
| #3914 | Meow Lightbox | 34 | 77 | 52 | 10k+ | | | Non Singular String Literal Domain |
| #3915 | Photospace Responsive Gallery | 83 | 115 | 14 | 900 | | | Text Domain Mismatch |
| #3916 | Pochipp | 35 | 27 | 102 | 20k+ | | | Non-prefixed global variable |
| #3917 | Responsive Owl Carousel for Elementor | 72 | 40 | 89 | 7k+ | | | Non-prefixed global variable |
| #3918 | Tawk.To Live Chat | 89 | 102 | 27 | 100k+ | | | wp function not compatible with requires wp |
| #3919 | User Spam Remover | 31 | 115 | 14 | 1k+ | | | Output is not escaped |
| #3920 | Serial Numbers – Ultimate License Manager for Selling, Licensing & Securely Delivering Digital Content with WooCommerce | 93 | 5 | 124 | 1k+ | | | Direct Query |
| #3921 | Viva Payments – Viva Wallet WooCommerce Payment Gateway | 36 | 97 | 32 | 1k+ | | | Non Singular String Literal Domain |
| #3922 | WP Before After Image Slider – Interactive Image and Video Comparison Plugin for WordPress | 42 | 112 | 17 | 1k+ | | | Text Domain Mismatch |
| #3923 | WP Counter | 36 | 86 | 43 | 800 | | | Output is not escaped |
| #3924 | WP Maintenance Mode & Site Under Construction | 38 | 72 | 57 | 3k+ | | | Output is not escaped |
| #3925 | Andreani WooCommerce | 37 | 23 | 105 | 800 | | | Non-prefixed global variable |
| #3926 | Any Mobile Theme Switcher | 38 | 69 | 59 | 20k+ | | | Output is not escaped |
| #3927 | bbPress Notify (No-Spam) | 35 | 62 | 66 | 2k+ | | | wp function not compatible with requires wp |
| #3928 | Better Random Redirect | 39 | 88 | 40 | 700 | | | Text Domain Mismatch |
| #3929 | DataFeedWatch Connector for WooCommerce | 64 | 16 | 112 | 600 | | | Non-prefixed hook name |
| #3930 | Datalogics Ecommerce Delivery – Datalogics | 39 | 13 | 115 | 500 | | | Nonce verification recommended |
| #3931 | Export Variable Products | 36 | 79 | 49 | 400 | | | Text Domain Mismatch |
| #3932 | Flexible Checkout Fields for WooCommerce – WooCommerce Checkout Manager | 35 | 64 | 64 | 80k+ | | | Non-prefixed global variable |
| #3933 | Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution | 42 | 111 | 17 | 20k+ | | | Exception output is not escaped |
| #3934 | GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor | 61 | 9 | 119 | 80k+ | | | Non-prefixed global variable |
| #3935 | Interactive Globes – 3D World Maps | 51 | 24 | 104 | 400 | | | Non-prefixed global variable |
| #3936 | Modal Dialog | 39 | 64 | 64 | 500 | | | Output is not escaped |
| #3937 | GoHero Store Customizer for WooCommerce | 37 | 75 | 53 | 600 | | | Unsafe printing function |
| #3938 | افزونه رسمی ترب | 36 | 42 | 86 | 30k+ | | | Exception output is not escaped |
| #3939 | Send link to friend | 41 | 81 | 47 | 400 | | | Output is not escaped |
| #3940 | Simple Image Sizes | 35 | 53 | 75 | 60k+ | | | Unsafe printing function |
| #3941 | Thin Out Revisions | 40 | 93 | 35 | 800 | | | Non Singular String Literal Domain |
| #3942 | Broadcast | 38 | 21 | 107 | 1k+ | | | Direct Query |
| #3943 | Unyson WooComerce Shortcodes | 82 | 117 | 11 | 1k+ | | | Text Domain Mismatch |
| #3944 | SharkDropship & Affiliate for AliExpress, eBay, Amazon, Etsy and Temu | 93 | 105 | 23 | 500 | | | Text Domain Mismatch |
| #3945 | Accessibility | 38 | 66 | 61 | 1k+ | | | Non-prefixed global variable |
| #3946 | Advanced Admin Search | 40 | 79 | 48 | 600 | | | Non Singular String Literal Text |
| #3947 | Dadevarzan WordPress Common | 35 | 56 | 71 | 700 | | | Text Domain Mismatch |
| #3948 | Genesis Footer Builder | 41 | 124 | 3 | 1k+ | | | Output is not escaped |
| #3949 | Highlight and Share – Unobtrusive and Lightweight Content Sharing | 74 | 12 | 115 | 700 | | | Non-prefixed hook name |
| #3950 | Kama Thumbnail | 28 | 80 | 47 | 9k+ | | | Output is not escaped |