| #6151 | Menubar | 39 | 171 | 46 | 1k+ | | | Output is not escaped |
| #6152 | MerPress | 96 | 6 | 3 | 1k+ | | | block api version too low |
| #6153 | Message Popup For Contact Form 7 | 42 | 30 | 81 | 1k+ | | | Missing nonce verification |
| #6154 | Masonry Image Gallery Block | 99 | 1 | 0 | 1k+ | | | outdated tested upto header |
| #6155 | MSN Partner Hub | 54 | 21 | 25 | 1k+ | | | Missing direct file access protection |
| #6156 | Migrate Store: Export and Import WooCommerce Settings | 38 | 37 | 33 | 1k+ | | | Non-prefixed global variable |
| #6157 | Lite Video Embed | 51 | 35 | 7 | 1k+ | | | Output is not escaped |
| #6158 | Mihdan: Yandex Turbo Feed | 41 | 65 | 39 | 1k+ | | | Output is not escaped |
| #6159 | WP OAuth Server ( Login with WordPress ) | 92 | 29 | 10 | 1k+ | | | wp function not compatible with requires wp |
| #6160 | Mizan Demo Importer | 39 | 31 | 91 | 1k+ | | | Missing nonce verification |
| #6161 | MO Cache | 97 | 3 | 3 | 1k+ | | | Non-prefixed hook name |
| #6162 | Mobile Contact Line | 40 | 39 | 355 | 1k+ | | | Non-prefixed global variable |
| #6163 | OTP Login & Register Woocommerce | 34 | 148 | 202 | 1k+ | | | Missing nonce verification |
| #6164 | MOBILOOK — Mobile View & Mobile‑Friendly Test | 53 | 10 | 20 | 1k+ | | | Missing nonce verification |
| #6165 | Receive customer payments on Woocommerce | 24 | 549 | 1,419 | 1k+ | | | Non-prefixed global variable |
| #6166 | Yoga Schedule Momoyoga | 92 | 3 | 2 | 1k+ | | | Missing Version |
| #6167 | Monobank WP Payment | 37 | 78 | 41 | 1k+ | | | Text Domain Mismatch |
| #6168 | Mooberry Book Manager | 21 | 1,040 | 399 | 1k+ | | | Text Domain Mismatch |
| #6169 | Moosend Website Connector | 64 | 15 | 12 | 1k+ | | | Non Singular String Literal Domain |
| #6170 | More Widgets | 35 | 55 | 15 | 1k+ | | | Output is not escaped |
| #6171 | Most And Least Read Posts Widget | 38 | 130 | 24 | 1k+ | | | Output is not escaped |
| #6172 | Mouse cursor customizer | 67 | 5 | 38 | 1k+ | | | Missing nonce verification |
| #6173 | mowomo Social Share | 34 | 202 | 156 | 1k+ | | | Output is not escaped |
| #6174 | MotoPress Hotel Booking for Divi | 95 | 22 | 11 | 1k+ | | | Missing direct file access protection |
| #6175 | Image Refresh | 35 | 4 | 6 | 1k+ | | | Dynamic hook name |
| #6176 | Multilingual Forms for Fluent Forms with WPML | 67 | 52 | 16 | 1k+ | | | Text Domain Mismatch |
| #6177 | MultiManager WP – Manage All Your WordPress Sites Easily | 91 | 28 | 11 | 1k+ | | | Missing Arg Domain |
| #6178 | Multipart robots.txt editor | 70 | 19 | 8 | 1k+ | | | Output is not escaped |
| #6179 | Multiple Admin Email Addresses | 74 | 7 | 4 | 1k+ | | | Missing nonce verification |
| #6180 | Music Player for WooCommerce | 29 | 106 | 155 | 1k+ | | | Non-prefixed global variable |
| #6181 | Social Proof Popups & Real-Time Notifications – Herd Effects | 39 | 5 | 181 | 1k+ | | | Non-prefixed global variable |
| #6182 | MX Time Zone Clocks | 38 | 219 | 41 | 1k+ | | | Output is not escaped |
| #6183 | My Favorites | 41 | 35 | 34 | 1k+ | | | Output is not escaped |
| #6184 | MyBookTable Bookstore by Stormhill Media | 82 | 15 | 33 | 1k+ | | | Direct Query |
| #6185 | Narrative Publisher | 44 | 28 | 37 | 1k+ | | | Text Domain Mismatch |
| #6186 | JSM Non-Breaking Space (nbsp) for French Content | 100 | | 2 | 1k+ | | | Discouraged text-domain loading |
| #6187 | Nearby Now Reviews and Audio Testimonials | 37 | 66 | 67 | 1k+ | | | wp function not compatible with requires wp |
| #6188 | Nepali Date Utilities | 41 | 51 | 15 | 1k+ | | | date date |
| #6189 | Nested Shortcodes by Outerbridge | 98 | 4 | 0 | 1k+ | | | Missing direct file access protection |
| #6190 | Netgsm | 19 | 334 | 308 | 1k+ | | | Setting is missing a sanitization callback |
| #6191 | NETSENSAI Shield | 83 | 10 | 16 | 1k+ | | | Nonce verification recommended |
| #6192 | Contact Form Widget | 38 | 54 | 107 | 1k+ | | | Request data is not unslashed |
| #6193 | Grid Gallery – for Photo Gallery, Image Gallery & Portfolio | 41 | 9 | 74 | 1k+ | | | Request data is not unslashed |
| #6194 | Photo & Video Gallery – Image, Video & Portfolio | 77 | 4 | 10 | 1k+ | | | Missing Version |
| #6195 | Video Gallery YouTube Vimeo with Youtube API | 84 | 2 | 181 | 1k+ | | | Non-prefixed global variable |
| #6196 | news ticker benaceur | 37 | 1,097 | 31 | 1k+ | | | Output is not escaped |
| #6197 | Gutena Newsletter – Subscriber Block & Connect Mailchimp | 97 | 18 | 3 | 1k+ | | | Text Domain Mismatch |
| #6198 | Newsletter Subscription Form – User Subscriptions Form, Capture Email | 24 | 385 | 829 | 1k+ | | | Non-prefixed global variable |
| #6199 | Newspack Newsletters | 61 | 53 | 47 | 1k+ | | | Request data is not unslashed |
| #6200 | NEX-Forms ADD ON – Form Themes | 99 | 2 | 0 | 1k+ | | | Missing direct file access protection |