| #101 | Ads.txt File Manager By Magicbid | 100 | | 0 | 3k+ | | | No open findings |
| #102 | AboveWP Bulgarian Eurozone | 81 | 10 | 8 | 3k+ | | | Output is not escaped |
| #103 | Daisy Titles — Style & Hide Page and Post Titles | 92 | 1 | 5 | 3k+ | | | Discouraged text-domain loading |
| #104 | Product Addons and Product Options With Custom Fields – WowAddons | 100 | 2 | 1 | 3k+ | | | No Empty Strings |
| #105 | Table Of Content Block – Auto-Generate Clickable Table of Contents | 35 | 2 | 1 | 3k+ | | | Hidden files included |
| #106 | Custom iFrame – Embed PDFs, Videos, and External Content in WordPress (Elementor & Gutenberg) | 91 | 13 | 5 | 3k+ | | | wp function not compatible with requires wp |
| #107 | Easy Post Submission – Frontend Posting, Guest Publishing & Submit Content for WordPress | 94 | 1 | 18 | 3k+ | | | Non-prefixed hook name |
| #108 | BotWriter – AI Writer & SEO Content Generator | 35 | 16 | 504 | 3k+ | | | Direct Query |
| #109 | Better Post & Filter Widgets for Elementor | 84 | 7 | 27 | 3k+ | | | slow db query tax query |
| #110 | WordClever – AI Content Writer | 86 | 4 | 2 | 3k+ | | | Missing direct file access protection |
| #111 | Simple Pin It Button for Pinterest | 99 | 1 | 0 | 3k+ | | | outdated tested upto header |
| #112 | KP Zip Downloader | 99 | 2 | 0 | 3k+ | | | file system operations readfile |
| #113 | Mosaic Gallery – Advanced Gallery | 67 | 45 | 79 | 3k+ | | | Non-prefixed global variable |
| #114 | Magnify – Suggestive Search Plugin | 100 | | 2 | 3k+ | | | trademarked term |
| #115 | Advanced Appointment Booking & Scheduling | 83 | 11 | 13 | 3k+ | | | Text Domain Mismatch |
| #116 | TableKit: Table Builder Blocks for Gutenberg | 56 | 80 | 20 | 3k+ | | | Missing Translators Comment |
| #117 | DefendWP Firewall | 39 | 16 | 203 | 3k+ | | | Non-prefixed global variable |
| #118 | WebP Conversion | 82 | 1 | 33 | 3k+ | | | Non-prefixed global variable |
| #119 | Plover Kit – Blocks, Patterns, Responsive Layout and Gutenberg Editor Enhancements | 25 | 685 | 1,382 | 3k+ | | | Non-prefixed global variable |
| #120 | WindPress – Tailwind CSS integration for WordPress | 71 | 16 | 106 | 3k+ | | | Non-prefixed hook name |
| #121 | Timeline Module for Divi | 84 | 16 | 11 | 3k+ | | | Text Domain Mismatch |
| #122 | Better Business Reviews – Trustpilot WordPress Plugin | 85 | 4 | 7 | 3k+ | | | Output is not escaped |
| #123 | WP Go Maps Block | 98 | 1 | 10 | 3k+ | | | Not In Footer |
| #124 | Desktop Mode | 36 | 1 | 587 | 2k+ | | | Direct Query |
| #125 | Vibe AI – MCP Server for WordPress. Connect Claude, ChatGPT & Cursor | 53 | 11 | 55 | 2k+ | | | Interpolated SQL is not prepared |
| #126 | ActiveLayer Anti-Spam: Spam Protection for Forms & Comments | 96 | | 2 | 2k+ | | | Database parameter is not escaped |
| #127 | IndexMeNow | 99 | 1 | 0 | 2k+ | | | outdated tested upto header |
| #128 | SurveyX Builder – Easy Feedback, Poll, Quiz & Survey | 81 | | 22 | 2k+ | | | Interpolated SQL is not prepared |
| #129 | ThemeRuby Multi Authors – Assign Multiple Writers to Posts | 98 | 3 | 4 | 2k+ | | | wp function not compatible with requires wp |
| #130 | Light Views Counter – Fast, Scalable View Counter for High-Traffic Sites | 89 | 2 | 11 | 2k+ | | | Database parameter is not escaped |
| #131 | MaxLimits – Increase Maximum Upload, Post & PHP Limits | 41 | 99 | 16 | 2k+ | | | Unsafe printing function |
| #132 | WPChat – Live Chat & Messaging Widget for Customer Support | 89 | 6 | 7 | 2k+ | | | wp function not compatible with requires wp |
| #133 | AxiaChat AI – Free AI Chatbot (Answers Customers Automatically) | 40 | 2 | 135 | 2k+ | | | Interpolated SQL is not prepared |
| #134 | تقویم فارسی – Persian Calendar | 79 | 2 | 8 | 2k+ | | | Nonce verification recommended |
| #135 | AL Pack | 29 | 13 | 816 | 2k+ | | | Non-prefixed global variable |
| #136 | Advanced IP Blocker | 40 | 94 | 43 | 2k+ | | | Exception output is not escaped |
| #137 | WS Action Scheduler Cleaner | 48 | 13 | 80 | 2k+ | | | error log error log |
| #138 | Tasty Recipes Lite | 82 | 7 | 66 | 2k+ | | | Non-prefixed global variable |
| #139 | TextBulker (IA Redaction) | 99 | 1 | 2 | 2k+ | | | Discouraged text-domain loading |
| #140 | گیتلند | درگاه پرداخت هوشمند گیتلند | 28 | 327 | 235 | 2k+ | | | Output is not escaped |
| #141 | Smaily Connect | 87 | | 52 | 2k+ | | | Non-prefixed global variable |
| #142 | Animated Floating Chat Button | 95 | | 3 | 2k+ | | | Nonce verification recommended |
| #143 | aapanel WP Toolkit | 71 | 20 | 18 | 2k+ | | | wp function not compatible with requires wp |
| #144 | Advanced Marquee Effect for Elementor | 80 | 11 | 4 | 2k+ | | | Output is not escaped |
| #145 | Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More | 89 | 13 | 20 | 2k+ | | | wp function not compatible with requires wp |
| #146 | Advanced Country Blocker | 40 | 23 | 77 | 2k+ | | | Exception output is not escaped |
| #147 | Justify for Paragraph Block | 99 | 1 | 0 | 2k+ | | | outdated tested upto header |
| #148 | ContentProtector – password protect your page, post or text | 95 | 1 | 3 | 2k+ | | | Non-prefixed class |
| #149 | Hydra Booking — Appointment Scheduling & Booking Calendar | 25 | 235 | 699 | 2k+ | | | Non-prefixed global variable |
| #150 | SmartSMTP | 71 | 8 | 42 | 2k+ | | | Nonce verification recommended |
