| #9001 | Language Switcher – Polylang for Divi | 98 | | 43 | 500 | | | Non-prefixed global variable |
| #9002 | Laposta WooCommerce | 29 | 96 | 115 | 500 | | | Non-prefixed global variable |
| #9003 | Last Name First Name | 79 | 9 | 5 | 500 | | | Non-prefixed function |
| #9004 | Last Viewed Posts by WPBeginner | 98 | 3 | 4 | 500 | | | Missing direct file access protection |
| #9005 | Leartes TRY Exchange Rates | 36 | 250 | 27 | 500 | | | Text Domain Mismatch |
| #9006 | Lemon Squeezy — Sell Digital Products, Subscriptions, and Licenses | 99 | 1 | 5 | 500 | | | Non-prefixed constant |
| #9007 | LH Dashboard Notes | 97 | 16 | 1 | 500 | | | Missing Arg Domain |
| #9008 | LH Page Links To | 42 | 25 | 38 | 500 | | | Output is not escaped |
| #9009 | Library Bookshelves | 48 | 12 | 59 | 500 | | | Nonce verification recommended |
| #9010 | LINE Auto Post | 45 | 19 | 11 | 500 | | | Heredoc Output Not Escaped |
| #9011 | Linked Variations for WooCommerce – Link Separate Products by Attribute with Swatches, Quick View & Shortcodes | 97 | 12 | 34 | 500 | | | Non-prefixed global variable |
| #9012 | List View Google Calendar | 100 | | 0 | 500 | | | No open findings |
| #9013 | Liteweight Podcast – Host and Embed Podcast Episodes | 29 | 536 | 239 | 500 | | | Output is not escaped |
| #9014 | Login Me Now – Passwordless, Magic Link, OTP & Social Login for WordPress | 29 | 86 | 233 | 500 | | | Nonce verification recommended |
| #9015 | Logout Clear Cookies | 98 | 3 | 1 | 500 | | | Missing direct file access protection |
| #9016 | Loop Post Navigation Links | 91 | 7 | 5 | 500 | | | Missing Arg Domain |
| #9017 | Lorem Ipsum Block – Placeholders for everyone | 99 | 2 | 2 | 500 | | | mismatched plugin name |
| #9018 | Lazy Blocks: Select Dynamic Control | 99 | 1 | 2 | 500 | | | Discouraged text-domain loading |
| #9019 | Maestro Connector | 97 | 7 | 4 | 500 | | | Missing direct file access protection |
| #9020 | Mailster Mailgun Integration | 77 | 16 | 5 | 500 | | | Missing Translators Comment |
| #9021 | Marin Companion | 87 | 19 | 66 | 500 | | | Non-prefixed global variable |
| #9022 | Mark New Posts | 40 | 61 | 39 | 500 | | | Non Singular String Literal Domain |
| #9023 | Markdown for AI Agents | 99 | 1 | 1 | 500 | | | Non-prefixed class |
| #9024 | Gist All-In-One Marketing – Live Chat, Popups, Email | 69 | 24 | 11 | 500 | | | Output is not escaped |
| #9025 | MATE Recently Viewed Products – Cache Compatible for WooCommerce | 99 | 1 | 0 | 500 | | | outdated tested upto header |
| #9026 | Mentions Legales Par Webdeclic | 61 | 82 | 39 | 500 | | | Non Singular String Literal Domain |
| #9027 | Menu Caching | 87 | 3 | 12 | 500 | | | Request data is not unslashed |
| #9028 | Menu Visibility Control | 99 | 1 | 0 | 500 | | | outdated tested upto header |
| #9029 | Merchant Center Reviews for WooCommerce | 89 | 2 | 11 | 500 | | | Missing Version |
| #9030 | MetalpriceAPI | 97 | 4 | 4 | 500 | | | Missing direct file access protection |
| #9031 | Group chat for WordPress – Minnit Chat | 38 | 39 | 65 | 500 | | | Non-prefixed global variable |
| #9032 | Mobile Call Buttons | 97 | 1 | 1 | 500 | | | Input is not validated |
| #9033 | Mobile CSS | 42 | 59 | 7 | 500 | | | Output is not escaped |
| #9034 | Modal Dialog | 39 | 64 | 64 | 500 | | | Output is not escaped |
| #9035 | Molongui Post Contributors: Multi-Role Contributor Attribution | 33 | 240 | 162 | 500 | | | Output is not escaped |
| #9036 | MONEI Payments for WooCommerce | 35 | 15 | 65 | 500 | | | Non-prefixed hook name |
| #9037 | More Mails for CF7 | 78 | 13 | 6 | 500 | | | Text Domain Mismatch |
| #9038 | Xpro Slider For Beaver Builder – Lite | 70 | 147 | 13 | 500 | | | Text Domain Mismatch |
| #9039 | Multilevel Navigation Menu | 44 | 80 | 1 | 500 | | | Output is not escaped |
| #9040 | Admin Bookmarks | 76 | 30 | 4 | 500 | | | Text Domain Mismatch |
| #9041 | My auctions allegro | 28 | 483 | 235 | 500 | | | Non Singular String Literal Domain |
| #9042 | Uptime Monitoring for WordPress – My Website is Online | 78 | 18 | 7 | 500 | | | Text Domain Mismatch |
| #9043 | mypace Custom Title Tag | 88 | 3 | 6 | 500 | | | Input is not sanitized |
| #9044 | N360 | Splash Screen | 46 | 32 | 13 | 500 | | | Output is not escaped |
| #9045 | Nav Menu Item Duplicator | 90 | 16 | 4 | 500 | | | wp function not compatible with requires wp |
| #9046 | Naver webmaster syndication v2 | 30 | 89 | 129 | 500 | | | Output is not escaped |
| #9047 | New Recent Posts Select Categories By Thao Marky | 64 | 33 | 1 | 500 | | | Text Domain Mismatch |
| #9048 | NewsmanApp | 94 | 747 | 4 | 500 | | | Text Domain Mismatch |
| #9049 | NextGEN Gallery Sidebar Widget | 40 | 59 | 10 | 500 | | | Output is not escaped |
| #9050 | NGD Custom Add to Cart Label for WooCommerce | 98 | 2 | 0 | 500 | | | mismatched tested up to header |
