| #1 | AI Agent by SiteGround | 53 | 35 | 6 | 1m+ | | | Exception output is not escaped |
| #2 | Hostinger Reach – AI-Powered Email Marketing for WordPress | 39 | 12 | 51 | 1m+ | | | Direct Query |
| #3 | CookieAdmin – Cookie Consent Banner | 37 | 47 | 93 | 400k+ | | | Nonce verification recommended |
| #4 | SureRank SEO – Meta Tags, Social Preview, XML Sitemap, Schema & Open Graph | 78 | 54 | 111 | 300k+ | | | Non-prefixed hook name |
| #5 | SureMail – SMTP and Email Logs Plugin with Amazon SES, Postmark, and Other Providers | 79 | 46 | 66 | 200k+ | | | Non-prefixed hook name |
| #6 | WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice) | 97 | 3 | 6 | 200k+ | | | trademarked term |
| #7 | FormLayer | 67 | 2 | 35 | 100k+ | | | Database parameter is not escaped |
| #8 | Manage – Centralized site maintenance and monitoring | 95 | 5 | 47 | 100k+ | | | Direct Query |
| #9 | Angie – Agentic AI | 97 | | 20 | 100k+ | | | Discouraged PHP function |
| #10 | Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress | 24 | 2,047 | 1,051 | 100k+ | | | Output is not escaped |
| #11 | Secure Custom Fields | 23 | 240 | 1,377 | 100k+ | | | Non-prefixed function |
| #12 | Reddit for WooCommerce | 98 | | 17 | 80k+ | | | Dynamic hook name |
| #13 | Snapchat for WooCommerce | 98 | 1 | 16 | 80k+ | | | Dynamic hook name |
| #14 | Hello Plus | 94 | 15 | 38 | 70k+ | | | Post Not In exclude |
| #15 | Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers | 51 | 37 | 103 | 70k+ | | | Direct Query |
| #16 | Modern Cart – WooCommerce Side Cart & Popup Cart | 86 | 34 | 96 | 60k+ | | | Non-prefixed global variable |
| #17 | Accessibility Widget by OneTap – Easy One-Click Accessibility Toolbar | 98 | 4 | 21 | 60k+ | | | Non-prefixed global variable |
| #18 | eRecht24 Legal Texts | 100 | | 0 | 50k+ | | | No open findings |
| #19 | SureCookie – GDPR Cookie Consent Banner, Cookie Scanner & Script Blocking | 77 | 47 | 55 | 50k+ | | | Missing Arg Domain |
| #20 | AI Provider for OpenAI | 64 | 33 | 2 | 50k+ | | | Exception output is not escaped |
| #21 | AI Provider for Anthropic | 78 | 13 | 2 | 50k+ | | | Exception output is not escaped |
| #22 | AI | 73 | 11 | 190 | 50k+ | | | Non-prefixed namespace |
| #23 | WP All Import – Import Add-On for ACF | 85 | 2 | 48 | 50k+ | | | Non-prefixed global variable |
| #24 | Spectra Blocks – AI Website Builder for the Block Editor | 35 | 238 | 1,298 | 40k+ | | | Non-prefixed global variable |
| #25 | Cookie Consent – GDPR & CCPA Cookie Banner & Consent Manager | 91 | 2 | 16 | 40k+ | | | Direct Query |
| #26 | AI Provider for Google | 62 | 37 | 2 | 40k+ | | | Exception output is not escaped |
| #27 | Website LLMs.txt | 36 | 26 | 199 | 40k+ | | | Non-prefixed global variable |
| #28 | WPVibe – WordPress MCP Server. Connect Claude, ChatGPT & Any AI Agent via MCP | 33 | 54 | 121 | 30k+ | | | Missing Translators Comment |
| #29 | SocialFeeds | 86 | | 11 | 30k+ | | | Nonce verification recommended |
| #30 | Cloudways Site Manager | 92 | 8 | 7 | 30k+ | | | Database parameter is not escaped |
| #31 | Power Coupons for WooCommerce | 90 | 42 | 95 | 30k+ | | | Non-prefixed global variable |
| #32 | Royal WordPress Backup, Restore & Migration Plugin – Backup WordPress Sites Safely | 53 | 34 | 90 | 30k+ | | | Database parameter is not escaped |
| #33 | Header Footer Builder for Elementor | 99 | | 5 | 30k+ | | | Non-prefixed class |
| #34 | QODE Optimizer | 74 | 1 | 249 | 30k+ | | | Non-prefixed global variable |
| #35 | Universally – AI Translation & Multilingual SEO: Translate Your Site into 110+ Languages | 100 | | 1 | 20k+ | | | mismatched plugin name |
| #36 | WP All Export – Export Add-On for ACF | 98 | 1 | 5 | 20k+ | | | trademarked term |
| #37 | WooCommerce Analytics | 93 | | 25 | 20k+ | | | Direct Query |
| #38 | Marquee Addons for Elementor – Essential Motion Widgets & Templates | 94 | 2 | 24 | 20k+ | | | Post Not In exclude |
| #39 | ShareMyPost | 100 | | 0 | 10k+ | | | No open findings |
| #40 | BeyondSEO – AI SEO to Improve Rankings, Listings & Online Visibility | 56 | 18 | 52 | 10k+ | | | Non-prefixed global variable |
| #41 | Easy MCP AI – Connect Claude to WordPress: MCP Server for ChatGPT & AI Agents | 90 | 3 | 12 | 10k+ | | | Database parameter is not escaped |
| #42 | LegalBlink for Aruba | 91 | 33 | 29 | 10k+ | | | Missing direct file access protection |
| #43 | Soro – SEO Autopilot & AI Content Writer | 83 | 4 | 10 | 10k+ | | | Input is not sanitized |
| #44 | Royal MCP – Secure AI Connector for Claude, ChatGPT & any LLM via MCP | 37 | 47 | 130 | 10k+ | | | Interpolated SQL is not prepared |
| #45 | SureContact – Newsletters, Email Marketing, Automation, Revenue Tracking & CRM | 36 | 310 | 132 | 10k+ | | | Text Domain Mismatch |
| #46 | Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads | 77 | 17 | 1 | 10k+ | | | Exception output is not escaped |
| #47 | Auto Login for Sakura Rental Server | 35 | 3 | 3 | 10k+ | | | Hidden files included |
| #48 | Cimo – Free Instant Image Optimizer & WebP Converter | 90 | 7 | 4 | 10k+ | | | Missing Translators Comment |
| #49 | ThinkRank AI SEO – AI SEO Plugin for WordPress: Schema, XML Sitemaps, Meta Tags, Search Console & Local SEO | 75 | | 198 | 10k+ | | | Direct Query |
| #50 | Instant Back/Forward | 99 | | 5 | 10k+ | | | Non-prefixed hook name |
