| #451 | User Switching | 63 | 2 | 47 | 200k+ | | | Nonce verification recommended |
| #452 | WPvivid — Backup, Migration & Staging | 25 | 900 | 1,461 | 900k+ | | | Non-prefixed namespace |
| #453 | PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) | 20 | 440 | 750 | 400 | | | Missing direct file access protection |
| #454 | FACTO – Facturación Electrónica | 22 | 242 | 432 | 400 | | | Request data is not unslashed |
| #455 | Duplicate Killer – Prevent Duplicate Form Submissions | 39 | 57 | 103 | 1k+ | | | Non-prefixed global variable |
| #456 | Extra Product Options Builder for WooCommerce | 31 | 113 | 194 | 2k+ | | | Non-prefixed global variable |
| #457 | Salon Booking System – Free Version | 22 | 655 | 620 | 2k+ | | | Missing direct file access protection |
| #458 | PayU CommercePro Plugin | 37 | | 218 | 7k+ | | | error log error log |
| #459 | PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes | 24 | 421 | 583 | 10k+ | | | Missing Translators Comment |
| #460 | Order Tracking – WordPress Status Tracking Plugin | 28 | 619 | 773 | 3k+ | | | Unsafe printing function |
| #461 | Ultimate FAQ Accordion Plugin | 28 | 386 | 227 | 30k+ | | | Unsafe printing function |
| #462 | The Events Calendar | 23 | 3,509 | 3,850 | 700k+ | | | Text Domain Mismatch |
| #463 | Greenshift – animation and page builder blocks | 34 | 33 | 272 | 70k+ | | | Non-prefixed global variable |
| #464 | JetBackup – Backup, Restore & Migrate | 10 | 1,563 | 149 | 200k+ | | | Exception output is not escaped |
| #465 | Members – Membership & User Role Editor Plugin | 32 | 233 | 259 | 300k+ | | | Output is not escaped |
| #466 | Google for WooCommerce | 37 | 328 | 121 | 800k+ | | | Exception output is not escaped |
| #467 | ST Elementor Addons | 28 | 224 | 374 | 500 | | | Non-prefixed global variable |
| #468 | Bazz CallBack widget | 42 | 55 | 28 | 3k+ | | | Unsafe printing function |
| #469 | AI Puffer – Chat. Create. Automate. (formerly AI Power) | 91 | 2 | 0 | 10k+ | | | Output is not escaped |
| #470 | Post Export Import with Media | 90 | 34 | 41 | 1k+ | | | Missing Translators Comment |
| #471 | Product Configurator for WooCommerce | 31 | 41 | 562 | 3k+ | | | Non-prefixed hook name |
| #472 | FluentCommunity – Ultra-Fast High-Performance Social Network, Community, LMS & Online Courses | 59 | 41 | 14 | 8k+ | | | Exception output is not escaped |
| #473 | Postie | 23 | 408 | 259 | 10k+ | | | Output is not escaped |
| #474 | Payment Plugins for PayPal WooCommerce | 28 | 229 | 244 | 80k+ | | | Non-prefixed hook name |
| #475 | Joinchat – Enhanced "click to chat" | 81 | 17 | 32 | 700k+ | | | wp function not compatible with requires wp |
| #476 | FluentPlayer – Video Player With Forms & Lead Capture | 75 | 10 | 40 | 1k+ | | | Database parameter is not escaped |
| #477 | Plugin Groups | 73 | 16 | 12 | 1k+ | | | Non Singular String Literal Domain |
| #478 | MyBookTable Bookstore by Stormhill Media | 82 | 16 | 34 | 1k+ | | | Direct Query |
| #479 | Events Calendar for GeoDirectory | 27 | 1,262 | 462 | 2k+ | | | Text Domain Mismatch |
| #480 | Bookit — Booking & Appointment Calendar | 25 | 565 | 1,458 | 4k+ | | | Non-prefixed global variable |
| #481 | Payment forms, Buy now buttons, and Invoicing System | GetPaid | 23 | 389 | 1,266 | 5k+ | | | Non-prefixed global variable |
| #482 | DoLogin Security | 100 | | 0 | 7k+ | | | No open findings |
| #483 | Order on Mobile for WooCommerce | 84 | 14 | 1 | 7k+ | | | Output is not escaped |
| #484 | QuickWebP – Compress / Optimize Images & Convert WebP | SEO Friendly | 35 | 225 | 110 | 8k+ | | | Non Singular String Literal Domain |
| #485 | All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) | 97 | 20 | 4 | 3m+ | | | wp function not compatible with requires wp |
| #486 | Search and Replace for Block Editor | 91 | 2 | 1 | 700 | | | Output is not escaped |
| #487 | Image Converter for WebP | 90 | 5 | 1 | 800 | | | wp function not compatible with requires wp |
| #488 | AidWP – Donation & Payment Forms (Stripe Powered) | 39 | | 193 | 800 | | | Non-prefixed global variable |
| #489 | BT iPay Payments | 98 | 2 | 13 | 900 | | | Non-prefixed global variable |
| #490 | Shipment Tracker for Woocommerce | 23 | 477 | 576 | 2k+ | | | Missing Arg Domain |
| #491 | Simple File List | 93 | 1 | 525 | 3k+ | | | Non-prefixed global variable |
| #492 | WPZOOM Addons for Beaver Builder | 30 | 2,168 | 177 | 4k+ | | | Text Domain Mismatch |
| #493 | Additional Variation Images Gallery for WooCommerce | 40 | 60 | 129 | 20k+ | | | Non-prefixed global variable |
| #494 | Disabler | 64 | 212 | 38 | 900 | | | Text Domain Mismatch |
| #495 | POS Entegratör – Gurmehub Ödeme Eklentisi | 68 | 1,321 | 69 | 1k+ | | | Text Domain Mismatch |
| #496 | Prevent Files / Folders Access | 100 | | 0 | 1k+ | | | No open findings |
| #497 | Simple Link Directory – AI Powered | 25 | 133 | 420 | 2k+ | | | Non-prefixed global variable |
| #498 | License Manager for WooCommerce | 23 | 129 | 797 | 6k+ | | | Nonce verification recommended |
| #499 | Product Carousel Slider & Grid Ultimate for WooCommerce | 29 | 719 | 122 | 6k+ | | | Text Domain Mismatch |
| #500 | YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports | 22 | 654 | 435 | 10k+ | | | Exception output is not escaped |