| #1 | AI Agent by SiteGround | 54 | 28 | 6 | 1m+ | | | Exception output is not escaped |
| #2 | Hostinger Reach – AI-Powered Email Marketing for WordPress | 40 | 9 | 49 | 1m+ | | | Direct Query |
| #3 | CookieAdmin – Cookie Consent Banner | 37 | 43 | 86 | 400k+ | | | Nonce verification recommended |
| #4 | SureRank SEO – Smart Assistant with Meta Tags, Social Preview, XML Sitemap, and Schema | 77 | 58 | 103 | 300k+ | | | Non-prefixed hook name |
| #5 | SureMail – SMTP and Email Logs Plugin with Amazon SES, Postmark, and Other Providers | 79 | 45 | 66 | 200k+ | | | Non-prefixed hook name |
| #6 | Email Deliverability – SMTP Replacement, Email API Deliverability & Email Log | 74 | 8 | 23 | 200k+ | | | Output is not escaped |
| #7 | FormLayer | 74 | | 32 | 100k+ | | | Database parameter is not escaped |
| #8 | Angie – Agentic AI | 98 | | 17 | 100k+ | | | Discouraged PHP function |
| #9 | Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress | 24 | 1,876 | 957 | 100k+ | | | Output is not escaped |
| #10 | WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice) | 99 | | 6 | 100k+ | | | trademarked term |
| #11 | Secure Custom Fields | 23 | 240 | 1,377 | 90k+ | | | Non-prefixed function |
| #12 | Manage – Centralized site maintenance and monitoring | 95 | 5 | 47 | 80k+ | | | Direct Query |
| #13 | Hello Plus | 94 | 15 | 38 | 80k+ | | | Post Not In exclude |
| #14 | Reddit for WooCommerce | 98 | | 17 | 70k+ | | | Dynamic hook name |
| #15 | Snapchat for WooCommerce | 98 | 1 | 12 | 70k+ | | | Dynamic hook name |
| #16 | Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers | 84 | 1 | 73 | 70k+ | | | Direct Query |
| #17 | Modern Cart – WooCommerce Side Cart & Popup Cart | 86 | 8 | 95 | 60k+ | | | Non-prefixed global variable |
| #18 | eRecht24 Legal Texts | 100 | | 0 | 50k+ | | | No open findings |
| #19 | Accessibility Widget by OneTap – Easy One-Click Accessibility Toolbar | 98 | 4 | 19 | 50k+ | | | Non-prefixed global variable |
| #20 | WP All Import – Import Add-On for ACF | 85 | 2 | 48 | 50k+ | | | Non-prefixed global variable |
| #21 | AI Provider for Anthropic | 78 | 13 | 1 | 40k+ | | | Exception output is not escaped |
| #22 | AI | 81 | 11 | 79 | 40k+ | | | Non-prefixed global variable |
| #23 | Website LLMs.txt | 36 | 23 | 202 | 40k+ | | | Non-prefixed global variable |
| #24 | SocialFeeds | 90 | | 10 | 30k+ | | | Nonce verification recommended |
| #25 | AI Provider for OpenAI | 76 | 15 | 1 | 30k+ | | | Exception output is not escaped |
| #26 | AI Provider for Google | 65 | 32 | 1 | 30k+ | | | Exception output is not escaped |
| #27 | Royal WordPress Backup, Restore & Migration Plugin – Backup WordPress Sites Safely | 53 | 34 | 90 | 30k+ | | | Database parameter is not escaped |
| #28 | QODE Optimizer | 74 | 1 | 249 | 30k+ | | | Non-prefixed global variable |
| #29 | Kliken: Ads + Pixel for Meta | 100 | | 2 | 30k+ | | | Discouraged text-domain loading |
| #30 | Spectra Blocks – AI Website Builder for the Block Editor | 35 | 241 | 1,292 | 20k+ | | | Non-prefixed global variable |
| #31 | Cookie Consent – GDPR & CCPA Cookie Banner & Consent Manager | 92 | 1 | 16 | 20k+ | | | Direct Query |
| #32 | Cloudways Site Manager | 91 | 14 | 7 | 20k+ | | | wp function not compatible with requires wp |
| #33 | Power Coupons for WooCommerce | 90 | 6 | 91 | 20k+ | | | Non-prefixed global variable |
| #34 | WP All Export – Export Add-On for ACF | 98 | 1 | 5 | 20k+ | | | trademarked term |
| #35 | Header Footer Builder for Elementor | 99 | | 6 | 20k+ | | | Non-prefixed class |
| #36 | WooCommerce Analytics | 93 | | 25 | 20k+ | | | Direct Query |
| #37 | Marquee Addons for Elementor – Essential Motion Widgets & Templates | 94 | 2 | 24 | 20k+ | | | Post Not In exclude |
| #38 | Universally – AI Translation & Multilingual SEO: Translate Your Site into 110+ Languages | 100 | | 1 | 10k+ | | | mismatched plugin name |
| #39 | SureCookie – Cookie Consent Banner, Cookie Scanner & Script Blocking | 88 | 44 | 49 | 10k+ | | | Missing Arg Domain |
| #40 | Soro – SEO Autopilot & AI Content Writer | 83 | 4 | 10 | 10k+ | | | Input is not sanitized |
| #41 | Royal MCP – Secure AI Connector for Claude, ChatGPT & Gemini | 40 | 28 | 52 | 10k+ | | | Interpolated SQL is not prepared |
| #42 | SureContact – Newsletters, Email Marketing, Automation, Revenue Tracking & CRM | 36 | 314 | 132 | 10k+ | | | Text Domain Mismatch |
| #43 | Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads | 77 | 17 | 1 | 10k+ | | | Exception output is not escaped |
| #44 | Auto Login for Sakura Rental Server | 35 | 3 | 3 | 10k+ | | | Hidden files included |
| #45 | Instant Back/Forward | 99 | | 5 | 10k+ | | | Non-prefixed hook name |
| #46 | Shiptastic Integration for DHL | 68 | 54 | 36 | 10k+ | | | Missing Translators Comment |
| #47 | Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy | 99 | | 2 | 10k+ | | | mismatched plugin name |
| #48 | Visa Acceptance Solutions | 100 | | 0 | 10k+ | | | No open findings |
| #49 | View Transitions | 99 | | 3 | 10k+ | | | Non-prefixed constant |
| #50 | EasyTest – Simplify A/B Testing | 35 | 9 | 76 | 10k+ | | | Non-prefixed global variable |
