| #3201 | Send Users Email – Email Subscribers, Email Marketing Newsletter | 26 | 188 | 415 | 5k+ | | | Non-prefixed global variable |
| #3202 | Sendcloud Shipping | 42 | 78 | 56 | 5k+ | | | Output is not escaped |
| #3203 | Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce | 29 | 148 | 246 | 5k+ | | | Unsafe printing function |
| #3204 | Seriously Simple Stats | 34 | 99 | 126 | 5k+ | | | Output is not escaped |
| #3205 | Shipping Simulator for WooCommerce | 39 | 120 | 39 | 5k+ | | | Text Domain Mismatch |
| #3206 | Shopkeeper Extender | 35 | 14 | 26 | 5k+ | | | Missing Version |
| #3207 | Shortcodes for Elementor | 98 | 5 | 3 | 5k+ | | | Missing direct file access protection |
| #3208 | Weaver Show Posts | 93 | | 2 | 5k+ | | | Input is not sanitized |
| #3209 | Simple Login Log | 100 | | 0 | 5k+ | | | No open findings |
| #3210 | Redirect | 51 | 26 | 12 | 5k+ | | | Output is not escaped |
| #3211 | Simple Website Redirect | 35 | 3 | 3 | 5k+ | | | Discouraged text-domain loading |
| #3212 | Simple YouTube Embed | 69 | 11 | 11 | 5k+ | | | Nonce verification recommended |
| #3213 | Site Favicon | 97 | 3 | 0 | 5k+ | | | invalid license |
| #3214 | Sliced Invoices – WordPress Invoice Plugin | 26 | 684 | 455 | 5k+ | | | Output is not escaped |
| #3215 | GutSlider – All in One Slider and Carousel Blocks for Gutenberg | 99 | | 9 | 5k+ | | | Non-prefixed global variable |
| #3216 | Slideshow Gallery LITE | 24 | 896 | 414 | 5k+ | | | Output is not escaped |
| #3217 | Smart Auto Upload Images – Import External Images | 35 | 2 | 1 | 5k+ | | | Hidden files included |
| #3218 | Smart Forms – when you need more than just a contact form | 21 | 776 | 574 | 5k+ | | | Output is not escaped |
| #3219 | SmartBill Facturare si Gestiune | 31 | 421 | 164 | 5k+ | | | Text Domain Mismatch |
| #3220 | SOGO Accessibility | 38 | 147 | 40 | 5k+ | | | Non Singular String Literal Domain |
| #3221 | SoundCloud Shortcode | 97 | 6 | 1 | 5k+ | | | Missing Arg Domain |
| #3222 | Sparkle Demo Importer | 28 | 307 | 166 | 5k+ | | | Text Domain Mismatch |
| #3223 | SQL Buddy – Database Management Made Easy | 65 | 12 | 16 | 5k+ | | | SQL query is not prepared |
| #3224 | Stop Emails | 82 | 9 | 3 | 5k+ | | | Missing direct file access protection |
| #3225 | Swatchly – Product Variation Swatches for WooCommerce | 31 | 540 | 214 | 5k+ | | | Output is not escaped |
| #3226 | TaxJar – Sales Tax Automation for WooCommerce | 34 | 236 | 170 | 5k+ | | | Text Domain Mismatch |
| #3227 | TCD Classic Editor | 83 | 1 | 11 | 5k+ | | | Nonce verification recommended |
| #3228 | Responsive Team Members Showcase, Team Grid, Team Slider, and Staff List – Smart Team (formerly WP Team) | 91 | 4 | 372 | 5k+ | | | Non-prefixed global variable |
| #3229 | The Events Calendar: Category Colors | 88 | 18 | 42 | 5k+ | | | Non-prefixed global variable |
| #3230 | Theme Demo Import | 50 | 101 | 95 | 5k+ | | | Non-prefixed hook name |
| #3231 | ThemeZee Widget Bundle | 42 | 211 | 58 | 5k+ | | | Output is not escaped |
| #3232 | Themify Builder | 9 | 5,209 | 2,125 | 5k+ | | | Text Domain Mismatch |
| #3233 | Timed Content | 40 | 76 | 63 | 5k+ | | | Unsafe printing function |
| #3234 | Toolbar Publish Button | 51 | 37 | 4 | 5k+ | | | Unsafe printing function |
| #3235 | Envato Toolkit | 33 | 219 | 69 | 5k+ | | | Output is not escaped |
| #3236 | Zoho ZeptoMail | 36 | 32 | 110 | 5k+ | | | Request data is not unslashed |
| #3237 | Turn Rank Math FAQ Block to Accordion | 99 | 1 | 0 | 5k+ | | | outdated tested upto header |
| #3238 | Ukr-To-Lat | 88 | 3 | 13 | 5k+ | | | Direct Query |
| #3239 | Ultimate Product Catalog | 24 | 554 | 525 | 5k+ | | | Unsafe printing function |
| #3240 | Unbloater | 41 | 57 | 18 | 5k+ | | | Output is not escaped |
| #3241 | UpdraftCentral Dashboard | 26 | 267 | 180 | 5k+ | | | Missing Translators Comment |
| #3242 | User Verification by PickPlugins | 29 | 41 | 314 | 5k+ | | | Request data is not unslashed |
| #3243 | Vertical News Scroller | 38 | 118 | 60 | 5k+ | | | Output is not escaped |
| #3244 | Vimeography: Vimeo Video Gallery WordPress Plugin | 24 | 98 | 212 | 5k+ | | | Nonce verification recommended |
| #3245 | Visual Website Optimizer | 48 | 86 | 4 | 5k+ | | | wp function not compatible with requires wp |
| #3246 | VLibras | 96 | 6 | 2 | 5k+ | | | Missing direct file access protection |
| #3247 | WC Cancel Order | 35 | 52 | 122 | 5k+ | | | Non-prefixed hook name |
| #3248 | Custom Add to Cart labels for WooCommerce | 98 | 3 | 5 | 5k+ | | | Non Singular String Literal Text |
| #3249 | WCMultiShipping — Mondial Relay, Inpost & Chronopost for WooCommerce | 24 | 733 | 499 | 5k+ | | | Output is not escaped |
| #3250 | Web-Stat | 89 | 2 | 6 | 5k+ | | | Input is not sanitized |