| #4251 | Debug Log Viewer | 37 | 26 | 83 | 1k+ | | | Missing nonce verification |
| #4252 | File Manager | 53 | 41 | 68 | 10k+ | | | Missing direct file access protection |
| #4253 | heatmap for WordPress – Realtime analytics | 40 | 94 | 15 | 1k+ | | | Non Singular String Literal Domain |
| #4254 | Idle User Logout | 39 | 96 | 13 | 1k+ | | | Output is not escaped |
| #4255 | MembershipWorks Login Connector | 43 | 28 | 81 | 800 | | | Request data is not unslashed |
| #4256 | Sticky Header 2020 | 98 | 107 | 2 | 700 | | | Text Domain Mismatch |
| #4257 | Video Blogster Lite | 39 | 29 | 80 | 700 | | | Missing nonce verification |
| #4258 | Eurobank WooCommerce Payment Gateway | 40 | 66 | 43 | 2k+ | | | Non Singular String Literal Domain |
| #4259 | mb.YTPlayer for background videos | 38 | 80 | 29 | 1k+ | | | Unsafe printing function |
| #4260 | AffiliateWP – Affiliate Product Rates | 41 | 84 | 24 | 1k+ | | | Output is not escaped |
| #4261 | AnimateGL Animations for WordPress – Elementor & Gutenberg Blocks Animations | 84 | 88 | 20 | 3k+ | | | Text Domain Mismatch |
| #4262 | Bandsintown Events | 60 | 80 | 28 | 4k+ | | | wp function not compatible with requires wp |
| #4263 | Bootstrap for Contact Form 7 | 35 | 35 | 73 | 10k+ | | | Nonce verification recommended |
| #4264 | Contact Form 7 GetResponse Extension | 40 | 90 | 18 | 1k+ | | | Text Domain Mismatch |
| #4265 | Currency Converter | 35 | 104 | 4 | 400 | | | Output is not escaped |
| #4266 | Customize Posts | 38 | 31 | 77 | 1k+ | | | Non-prefixed hook name |
| #4267 | Fluent PDF Generator | 80 | 102 | 6 | 20k+ | | | Text Domain Mismatch |
| #4268 | Anti-Spam Protection – No API Key, GDPR Friendly | 49 | 2 | 106 | 1k+ | | | Direct Query |
| #4269 | LLM Bot Tracker – AI Crawler Detection & Analytics | 40 | 18 | 90 | 800 | | | Database parameter is not escaped |
| #4270 | Push Notifications by LaraPush | 35 | 32 | 76 | 5k+ | | | Non-prefixed global variable |
| #4271 | Responsive Menu – Create Mobile-Friendly Menu | 34 | 68 | 40 | 70k+ | | | Nonce verification recommended |
| #4272 | SALERT – Fake Sales Notification WooCommerce | 42 | 41 | 67 | 8k+ | | | Non-prefixed global variable |
| #4273 | Squelch Tabs and Accordions Shortcodes | 42 | 57 | 51 | 1k+ | | | Unsafe printing function |
| #4274 | UiChemy — Figma Converter for Elementor, Gutenberg and Bricks | 39 | 8 | 100 | 9k+ | | | Nonce verification recommended |
| #4275 | WC Speed Repair | 42 | 34 | 74 | 1k+ | | | Non-prefixed global variable |
| #4276 | WP-Cleanup | 36 | 79 | 29 | 400 | | | Output is not escaped |
| #4277 | WP Nav Plus | 40 | 95 | 13 | 1k+ | | | Output is not escaped |
| #4278 | Social Share For WooCommerce | 76 | 85 | 23 | 500 | | | Text Domain Mismatch |
| #4279 | Advanced Custom Fields: Image Aspect Ratio Crop Field | 35 | 70 | 37 | 20k+ | | | Text Domain Mismatch |
| #4280 | Advanced Recent Posts Widget | 39 | 105 | 2 | 1k+ | | | Output is not escaped |
| #4281 | Advanced TinyMCE Configuration | 43 | 99 | 8 | 10k+ | | | Text Domain Mismatch |
| #4282 | Agreeable | 37 | 40 | 67 | 800 | | | Unsafe printing function |
| #4283 | Web3 Crypto Payments by DePay for WooCommerce | 78 | 6 | 101 | 1k+ | | | Direct Query |
| #4284 | Frontend Product Editor for WooCommerce | 78 | 76 | 31 | 400 | | | Text Domain Mismatch |
| #4285 | If-So Geolocation | 36 | 50 | 57 | 1k+ | | | Non-prefixed global variable |
| #4286 | REPORTiT – Advanced Reporting for WooCommerce | 81 | 9 | 98 | 700 | | | Non-prefixed global variable |
| #4287 | Laposta Signup Embed | 30 | 88 | 19 | 1k+ | | | Exception output is not escaped |
| #4288 | NewStatPress | 94 | 95 | 12 | 8k+ | | | wp function not compatible with requires wp |
| #4289 | Nginx Helper | 71 | 47 | 60 | 200k+ | | | Non-prefixed global variable |
| #4290 | Pay by paynow.pl | 39 | 51 | 56 | 6k+ | | | Output is not escaped |
| #4291 | Republish Old Posts | 42 | 83 | 24 | 2k+ | | | Output is not escaped |
| #4292 | RioVizual — Table Blocks for Comparison, Pricing and Pros & Cons | 39 | 32 | 75 | 1k+ | | | Nonce verification recommended |
| #4293 | Tumblr Widget | 40 | 106 | 1 | 400 | | | Output is not escaped |
| #4294 | Affiliate Sales in Google Analytics and other tools | 38 | 23 | 84 | 1k+ | | | Request data is not unslashed |
| #4295 | CiviCRM Admin Utilities | 35 | 19 | 87 | 1k+ | | | Non-prefixed hook name |
| #4296 | Conditional Add to Cart for WooCommerce | 88 | 2 | 104 | 600 | | | Non-prefixed global variable |
| #4297 | Conditional WooCommerce Checkout Field | 40 | 84 | 22 | 400 | | | Unsafe printing function |
| #4298 | Contact Form 7 Multi-Step Forms | 40 | 65 | 41 | 50k+ | | | Output is not escaped |
| #4299 | Dinamize | 41 | 41 | 65 | 500 | | | Output is not escaped |
| #4300 | Dintero Checkout for WooCommerce Payment Methods | 35 | 58 | 48 | 600 | | | Text Domain Mismatch |