| #951 | CF7 to Webhook | 38 | 102 | 72 | 30k+ | | | Unsafe printing function |
| #952 | Chatway Live Chat – AI Chatbot, Customer Support, FAQ & Helpdesk Customer Service & Chat Buttons | 69 | 22 | 24 | 30k+ | | | Text Domain Mismatch |
| #953 | Payment Gateway Based Fees and Discounts for WooCommerce | 35 | 24 | 68 | 30k+ | | | Non-prefixed hook name |
| #954 | Clean Image Filenames | 82 | 6 | 1 | 30k+ | | | Output is not escaped |
| #955 | Clever Fox | 91 | 16 | 1 | 30k+ | | | wp function not compatible with requires wp |
| #956 | Conditionally display featured image on singular posts and pages | 73 | 17 | 6 | 30k+ | | | Output is not escaped |
| #957 | Contact Form by BestWebSoft – Advanced WP Contact Form Builder for WordPress | 28 | 465 | 338 | 30k+ | | | Text Domain Mismatch |
| #958 | Maspik – Ultimate Spam Protection | 28 | 212 | 862 | 30k+ | | | Missing nonce verification |
| #959 | Content Aware Sidebars – Fastest Widget Area Plugin | 23 | 993 | 1,738 | 30k+ | | | Non-prefixed global variable |
| #960 | Cornerstone | 34 | 161 | 174 | 30k+ | | | Nonce verification recommended |
| #961 | Cost Calculator Builder | 21 | 322 | 766 | 30k+ | | | Non-prefixed global variable |
| #962 | Custom Field Template | 29 | 568 | 530 | 30k+ | | | wp function not compatible with requires wp |
| #963 | Cyr to Lat Reloaded – Transliteration of Links and File Names | 65 | 13 | 36 | 30k+ | | | Direct Query |
| #964 | Debloat – Remove Unused CSS, Optimize JS | 58 | 24 | 20 | 30k+ | | | Nonce verification recommended |
| #965 | DethemeKit for Elementor | 30 | 335 | 228 | 30k+ | | | Output is not escaped |
| #966 | Disable auto-update Email Notifications | 97 | 3 | 2 | 30k+ | | | Missing direct file access protection |
| #967 | Disable Emails | 60 | 25 | 16 | 30k+ | | | Short PHP open tag found |
| #968 | Disable Everything | 41 | 90 | 16 | 30k+ | | | Output is not escaped |
| #969 | Disable WP REST API | 93 | | 7 | 30k+ | | | Missing nonce verification |
| #970 | Display PHP Version | 96 | 6 | 2 | 30k+ | | | Missing direct file access protection |
| #971 | Ditty – Responsive News Tickers, Sliders, and Lists | 26 | 561 | 484 | 30k+ | | | Output is not escaped |
| #972 | Easy Social Feed – Social Photos Gallery and Post Feed for WordPress | 22 | 1,567 | 1,277 | 30k+ | | | Non-prefixed global variable |
| #973 | Easy Watermark | 35 | 82 | 53 | 30k+ | | | Non-prefixed global variable |
| #974 | Elementor Beta (Developer Edition) | 57 | 36 | 32 | 30k+ | | | Output is not escaped |
| #975 | Enhanced Text Widget | 34 | 101 | 58 | 30k+ | | | Output is not escaped |
| #976 | Export Media Library | 73 | 5 | 5 | 30k+ | | | Output is not escaped |
| #977 | FameTheme Demo Importer | 40 | 8 | 74 | 30k+ | | | Nonce verification recommended |
| #978 | FancyBox for WordPress | 60 | 175 | 33 | 30k+ | | | Text Domain Mismatch |
| #979 | Float menu – awesome floating side menu | 96 | 9 | 103 | 30k+ | | | Non-prefixed global variable |
| #980 | Flying Scripts: Delay JavaScript to Improve Site Speed & Performance | 40 | 23 | 44 | 30k+ | | | Missing direct file access protection |
| #981 | Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder | 23 | 4,746 | 1,279 | 30k+ | | | Non Singular String Literal Domain |
| #982 | FunnelKit – Funnel Builder for WooCommerce Checkout | 25 | 3,164 | 2,624 | 30k+ | | | Text Domain Mismatch |
| #983 | Gallery Custom Links | 33 | 64 | 62 | 30k+ | | | Non Singular String Literal Domain |
| #984 | Maps Widget for Google Maps | 99 | 1 | 2 | 30k+ | | | Short URL found |
| #985 | Logo Slider – Logo Showcase, Logo Carousel, Logo Gallery and Client Logo Presentation | 25 | 789 | 313 | 30k+ | | | Text Domain Mismatch |
| #986 | GTM Kit – Google Tag Manager & GA4 integration | 87 | 5 | 17 | 30k+ | | | Missing direct file access protection |
| #987 | Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor | 97 | | 35 | 30k+ | | | Post Not In post not in |
| #988 | Hide Title | 66 | 13 | 6 | 30k+ | | | Output is not escaped |
| #989 | ThumbPress – Compress Images, Manage Thumbnails, Detect Image Issues, WebP/AVIF, Lazy Loading, Hotlinking & More | 38 | 20 | 89 | 30k+ | | | Direct Query |
| #990 | IP2Location Country Blocker | 34 | 295 | 88 | 30k+ | | | Output is not escaped |
| #991 | Kadence Central – Site Management, Backups, Security, and Reporting | 26 | 462 | 213 | 30k+ | | | Text Domain Mismatch |
| #992 | Jetpack Social | 48 | 829 | 254 | 30k+ | | | Text Domain Mismatch |
| #993 | JetSticky For Elementor | 59 | 13 | 38 | 30k+ | | | Nonce verification recommended |
| #994 | Keon Toolset | 74 | 4 | 28 | 30k+ | | | Non-prefixed function |
| #995 | Klarna for WooCommerce | 26 | 284 | 507 | 30k+ | | | Dynamic hook name |
| #996 | Kliken: Ads + Pixel for Meta | 100 | | 2 | 30k+ | | | Discouraged text-domain loading |
| #997 | Leaflet Map | 39 | 59 | 32 | 30k+ | | | Output is not escaped |
| #998 | Lightweight Social Icons | 42 | 59 | 1 | 30k+ | | | Output is not escaped |
| #999 | Link Whisper Free | 23 | 3,882 | 5,303 | 30k+ | | | Text Domain Mismatch |
| #1000 | PiWeb Live sales notification for WooCommerce | 37 | 289 | 77 | 30k+ | | | Text Domain Mismatch |