| #901 | Visual Composer Website Builder | 16 | 82 | 320 | 40k+ | | | Non-prefixed global variable |
| #902 | WCBoost – Products Compare | 98 | | 17 | 40k+ | | | Non-prefixed global variable |
| #903 | Website LLMs.txt | 40 | 13 | 148 | 40k+ | | | Non-prefixed global variable |
| #904 | What The File | 35 | 9 | 12 | 40k+ | | | Input is not sanitized |
| #905 | Widget Context | 53 | 14 | 20 | 40k+ | | | Non-prefixed hook name |
| #906 | BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net | 32 | 5 | 933 | 40k+ | | | Non-prefixed global variable |
| #907 | Advanced Free Shipping for WooCommerce | 34 | 270 | 132 | 40k+ | | | Text Domain Mismatch |
| #908 | ShipStation for WooCommerce | 81 | | 34 | 40k+ | | | Non-prefixed class |
| #909 | WP Call Button – Easy Click to Call Button for WordPress | 54 | 21 | 38 | 40k+ | | | Non-prefixed global variable |
| #910 | Clone | 23 | 244 | 262 | 40k+ | | | Output is not escaped |
| #911 | WP Edit | 33 | 337 | 137 | 40k+ | | | Unsafe printing function |
| #912 | WP Extra File Types | 43 | 11 | 26 | 40k+ | | | Request data is not unslashed |
| #913 | Htaccess File Editor – Safely Edit Htaccess File | 96 | 4 | 15 | 40k+ | | | Non-prefixed global variable |
| #914 | WP Import Export Lite | 19 | 737 | 979 | 40k+ | | | Non-prefixed global variable |
| #915 | HireZoot – Job Listings, Career Page & Recruitment Tool | 26 | 80 | 620 | 40k+ | | | Non-prefixed global variable |
| #916 | LightPress Lightbox | 97 | 33 | 4 | 40k+ | | | Text Domain Mismatch |
| #917 | WP Last Modified Info | 79 | 45 | 32 | 40k+ | | | Short PHP open tag found |
| #918 | WP-Polls | 25 | 618 | 639 | 40k+ | | | Unsafe printing function |
| #919 | WP Revisions Control | 85 | 9 | 6 | 40k+ | | | wp function not compatible with requires wp |
| #920 | WP Robots Txt | 98 | 2 | 3 | 40k+ | | | trademarked term |
| #921 | WP RSS Aggregator – RSS Import, Feed to Post, Autoblogging, AI Content | 24 | 1,777 | 394 | 40k+ | | | Text Domain Mismatch |
| #922 | WP-SCSS | 34 | 269 | 13 | 40k+ | | | Exception output is not escaped |
| #923 | WPIDE – File Manager & Code Editor | 24 | 612 | 1,399 | 40k+ | | | Non-prefixed global variable |
| #924 | Visual CSS Style Editor | 36 | 283 | 233 | 40k+ | | | Output is not escaped |
| #925 | 301 Redirects & 404 Error Log | 97 | 4 | 20 | 30k+ | | | Non-prefixed global variable |
| #926 | Advanced Custom Fields: Gravity Forms Add-on | 78 | 33 | 13 | 30k+ | | | Text Domain Mismatch |
| #927 | ACF Quick Edit Fields | 49 | 20 | 72 | 30k+ | | | Nonce verification recommended |
| #928 | Advanced WordPress Backgrounds | 72 | 21 | 7 | 30k+ | | | Output is not escaped |
| #929 | Advanced Cron Manager – debug & control | 91 | 30 | 90 | 30k+ | | | Non-prefixed global variable |
| #930 | AI | 81 | 11 | 79 | 30k+ | | | Non-prefixed global variable |
| #931 | AI Provider for Anthropic | 78 | 13 | 1 | 30k+ | | | Exception output is not escaped |
| #932 | AI Provider for Google | 65 | 32 | 1 | 30k+ | | | Exception output is not escaped |
| #933 | AI Provider for OpenAI | 76 | 15 | 1 | 30k+ | | | Exception output is not escaped |
| #934 | AJAX Thumbnail Rebuild | 40 | 38 | 14 | 30k+ | | | Unsafe printing function |
| #935 | Schema – All In One Schema Rich Snippets | 43 | 601 | 188 | 30k+ | | | Text Domain Mismatch |
| #936 | WP Offload Media Lite for Amazon S3, DigitalOcean Spaces, and Google Cloud Storage | 96 | 8 | 12 | 30k+ | | | Missing direct file access protection |
| #937 | AntiVirus | 99 | 2 | 1 | 30k+ | | | Missing direct file access protection |
| #938 | Astra Bulk Edit | 91 | 4 | 3 | 30k+ | | | Missing direct file access protection |
| #939 | Autocomplete WooCommerce Orders | 76 | 70 | 55 | 30k+ | | | Text Domain Mismatch |
| #940 | AutoConvert Greeklish Permalinks | 40 | 116 | 13 | 30k+ | | | Text Domain Mismatch |
| #941 | Ultimate Before After Image Slider & Gallery – BEAF | 33 | 488 | 87 | 30k+ | | | Text Domain Mismatch |
| #942 | BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot | 91 | 2 | 32 | 30k+ | | | Non-prefixed global variable |
| #943 | Blackhole for Bad Bots | 39 | 123 | 69 | 30k+ | | | Output is not escaped |
| #944 | Blog Designer Pack – Blog, Post Grid, Post Slider, Post Carousel, Category Post, News | 24 | 699 | 1,693 | 30k+ | | | Non-prefixed global variable |
| #945 | BlossomThemes Toolkit | 35 | 347 | 52 | 30k+ | | | Output is not escaped |
| #946 | Customize WordPress Emails and Alerts – Better Notifications for WP | 37 | 64 | 47 | 30k+ | | | Missing Arg Domain |
| #947 | Custom Order Status Manager for WooCommerce | 35 | 630 | 67 | 30k+ | | | Text Domain Mismatch |
| #948 | Bulk Delete | 96 | 2 | 26 | 30k+ | | | slow db query meta key |
| #949 | Carousel Slider | 62 | | 71 | 30k+ | | | Non-prefixed global variable |
| #950 | Sliding Cart for WooCommerce by FunnelKit – Skip Cart & Reach WooCommerce Checkout Faster | 30 | 306 | 434 | 30k+ | | | Non-prefixed global variable |