| #4001 | Page Sidebar for Twenty Seventeen | 89 | 110 | 14 | 1k+ | | | Text Domain Mismatch |
| #4002 | Royal WordPress Backup, Restore & Migration Plugin – Backup WordPress Sites Safely | 53 | 34 | 90 | 20k+ | | | Database parameter is not escaped |
| #4003 | TypePad emoji for TinyMCE | 38 | 100 | 24 | 8k+ | | | Text Domain Mismatch |
| #4004 | Claudio Sanches – PagSeguro for WooCommerce | 39 | 87 | 37 | 10k+ | | | Unsafe printing function |
| #4005 | Fix Media Library | 37 | 53 | 71 | 1k+ | | | Output is not escaped |
| #4006 | WP REST Cache | 64 | 11 | 113 | 10k+ | | | Direct Query |
| #4007 | wp-Typography | 67 | 91 | 33 | 20k+ | | | Missing direct file access protection |
| #4008 | Categories to Tags Converter | 39 | 86 | 38 | 50k+ | | | Output is not escaped |
| #4009 | WP fail2ban Blocklist | 36 | 61 | 63 | 3k+ | | | SQL query is not prepared |
| #4010 | Ad Invalid Click Protector (AICP) | 35 | 78 | 45 | 10k+ | | | Text Domain Mismatch |
| #4011 | BIP Pages | 39 | 98 | 25 | 400 | | | Short PHP open tag found |
| #4012 | Claspo – Popups, Spin the Wheel & Email Capture | 78 | 107 | 16 | 1k+ | | | wp function not compatible with requires wp |
| #4013 | Custom post types, Custom Fields & more | 63 | 101 | 22 | 3k+ | | | Missing Translators Comment |
| #4014 | Display Featured Image for Genesis | 46 | 64 | 59 | 1k+ | | | Non-prefixed global variable |
| #4015 | GoDaddy Payments for WooCommerce | 38 | 58 | 65 | 2k+ | | | Output is not escaped |
| #4016 | Insert Amz Images | 39 | 79 | 44 | 1k+ | | | Output is not escaped |
| #4017 | MS Custom Login | 41 | 117 | 6 | 900 | | | Unsafe printing function |
| #4018 | Poptics – Popup Builder, Email Opt-ins, Exit-Intent & WooCommerce Popups Sales | 37 | 59 | 64 | 2k+ | | | SQL query is not prepared |
| #4019 | Repeater Fields for Elementor Forms | 91 | 115 | 8 | 700 | | | wp function not compatible with requires wp |
| #4020 | SMTP for SendGrid – YaySMTP | 36 | 27 | 96 | 1k+ | | | Non-prefixed global variable |
| #4021 | Where Did You Hear About Us Checkout Field for WooCommerce | 40 | 57 | 66 | 1k+ | | | Output is not escaped |
| #4022 | Better Usability for WooCommerce | 47 | 30 | 93 | 800 | | | Non-prefixed hook name |
| #4023 | WP Views Counter | 35 | 81 | 42 | 2k+ | | | Output is not escaped |
| #4024 | Advanced Sidebar Menu | 94 | 5 | 117 | 10k+ | | | Non-prefixed hook name |
| #4025 | SiteEase Bulk Delete Manager | 49 | 50 | 72 | 900 | | | Direct Query |
| #4026 | DarkMySite – Advanced Dark Mode Plugin for WordPress | 46 | 22 | 100 | 1k+ | | | Request data is not unslashed |
| #4027 | Dehkadeh Fonts | 63 | 117 | 5 | 800 | | | Text Domain Mismatch |
| #4028 | XML Sitemap Generator for Google | 37 | 43 | 79 | 1m+ | | | Input is not validated |
| #4029 | My Upload Images | 42 | 74 | 48 | 400 | | | Unsafe printing function |
| #4030 | Video Gallery – YouTube, Vimeo Gallery & YouTube API | 40 | 53 | 69 | 1k+ | | | Request data is not unslashed |
| #4031 | Live Chat & AI Chatbot – onWebChat | 41 | 31 | 91 | 700 | | | error log error log |
| #4032 | ActiveCampaign Postmark for WordPress | 36 | 47 | 75 | 50k+ | | | Text Domain Mismatch |
| #4033 | SHOPVOTE | 35 | 64 | 58 | 400 | | | curl curl setopt |
| #4034 | Text Unfold For Elementor | 88 | 122 | 0 | 3k+ | | | Text Domain Mismatch |
| #4035 | WindPress – Tailwind CSS integration for WordPress | 71 | 16 | 106 | 3k+ | | | Non-prefixed hook name |
| #4036 | Quickpay for WooCommerce | 37 | 66 | 56 | 4k+ | | | Nonce verification recommended |
| #4037 | Native PHP Sessions | 38 | 30 | 92 | 10k+ | | | Direct Query |
| #4038 | Social Share Buttons & Analytics Plugin – GetSocial.io | 40 | 97 | 25 | 2k+ | | | Output is not escaped |
| #4039 | All-in-One WP Migration and Backup | 34 | 52 | 69 | 5m+ | | | Missing nonce verification |
| #4040 | Booking Calendar | 51 | 28 | 93 | 50k+ | | | Mixed line endings |
| #4041 | Comments Import & Export | 85 | 112 | 9 | 2k+ | | | wp function not compatible with requires wp |
| #4042 | Decent Comments | 38 | 93 | 28 | 2k+ | | | Output is not escaped |
| #4043 | EchBay Phonering Alo | 33 | 74 | 47 | 1k+ | | | Output is not escaped |
| #4044 | Statify – Extended Evaluation | 95 | 2 | 119 | 20k+ | | | Non-prefixed global variable |
| #4045 | .htaccess Site Access Control | 37 | 54 | 67 | 800 | | | Input is not sanitized |
| #4046 | JVM Rich Text Icons | 37 | 87 | 34 | 3k+ | | | Output is not escaped |
| #4047 | Mentions Legales Par Webdeclic | 61 | 82 | 39 | 500 | | | Non Singular String Literal Domain |
| #4048 | Schema App Structured Data | 38 | 35 | 86 | 7k+ | | | Nonce verification recommended |
| #4049 | Sticky Floating Button (Book Now, Contact, Call To Action…) | 42 | 95 | 26 | 800 | | | Missing Arg Domain |
| #4050 | Table Addons for Elementor | 50 | 92 | 29 | 20k+ | | | wp function not compatible with requires wp |