| #9951 | Easy Table of Contents | 99 | 4 | 4 | 600k+ | | | Non-prefixed constant |
| #9952 | Under Construction | 35 | 3 | 0 | 600k+ | | | Hidden files included |
| #9953 | Header Footer Code Manager | 36 | 81 | 180 | 600k+ | | | Non-prefixed global variable |
| #9954 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder | 24 | 826 | 1,314 | 600k+ | | | Non-prefixed global variable |
| #9955 | Sucuri Security – Auditing, Malware Scanner and Security Hardening | 94 | 52 | 5 | 600k+ | | | Missing direct file access protection |
| #9956 | Post Types Order | 42 | 45 | 43 | 600k+ | | | wp function not compatible with requires wp |
| #9957 | Simple Custom CSS and JS | 37 | 168 | 69 | 600k+ | | | Output is not escaped |
| #9958 | TablePress – Tables in WordPress made easy | 25 | 847 | 2,174 | 600k+ | | | Non-prefixed global variable |
| #9959 | Backuply – Backup, Restore, Migrate and Clone | 24 | 704 | 551 | 700k+ | | | Non-prefixed global variable |
| #9960 | Click to Chat – HoliThemes | 99 | 6 | 2 | 700k+ | | | badly named files |
| #9961 | Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode | 25 | 99 | 1,035 | 700k+ | | | Non-prefixed global variable |
| #9962 | User Role Editor | 43 | 117 | 145 | 700k+ | | | Output is not escaped |
| #9963 | Joinchat – Enhanced "click to chat" | 81 | 18 | 32 | 700k+ | | | wp function not compatible with requires wp |
| #9964 | MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites | 38 | 3 | 136 | 700k+ | | | Non-prefixed hook name |
| #9965 | Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder | 22 | 409 | 236 | 700k+ | | | Text Domain Mismatch |
| #9966 | Antispam Bee | 80 | 4 | 38 | 700k+ | | | Nonce verification recommended |
| #9967 | Kadence Security – Password, Two Factor Authentication, and Brute Force Protection | 23 | 1,053 | 967 | 700k+ | | | Missing Translators Comment |
| #9968 | GTM4WP – A Google Tag Manager (GTM) plugin for WordPress | 91 | 59 | 79 | 700k+ | | | Non-prefixed global variable |
| #9969 | Flamingo | 40 | 15 | 228 | 800k+ | | | Nonce verification recommended |
| #9970 | Breadcrumb NavXT | 36 | 102 | 111 | 800k+ | | | Non Singular String Literal Domain |
| #9971 | Smart Slider 3 | 23 | 261 | 268 | 800k+ | | | Non-prefixed global variable |
| #9972 | Polylang | 26 | 36 | 564 | 800k+ | | | Non-prefixed hook name |
| #9973 | Autoptimize | 23 | 288 | 191 | 800k+ | | | Output is not escaped |
| #9974 | Translate WordPress with GTranslate | 32 | 82 | 364 | 900k+ | | | Non-prefixed global variable |
| #9975 | WPvivid — Backup, Migration & Staging | 25 | 899 | 1,461 | 900k+ | | | Non-prefixed namespace |
| #9976 | WP Multibyte Patch | 39 | 24 | 55 | 1m+ | | | Input is not sanitized |
| #9977 | Regenerate Thumbnails | 82 | 10 | 9 | 1m+ | | | Direct Query |
| #9978 | All-In-One Security (AIOS) – Security and Firewall | 24 | 552 | 1,228 | 1m+ | | | Non-prefixed global variable |
| #9979 | EWWW Image Optimizer | 35 | 225 | 729 | 1m+ | | | Direct Query |
| #9980 | Smash Balloon Social Photo Feed – Easy Social Feeds Plugin | 25 | 449 | 1,300 | 1m+ | | | Interpolated SQL is not prepared |
| #9981 | Image Optimizer – Optimize Images and Convert to WebP or AVIF | 87 | 14 | 24 | 1m+ | | | Missing Translators Comment |
| #9982 | Safe SVG | 98 | 7 | 4 | 1m+ | | | Missing Arg Domain |
| #9983 | XML Sitemap Generator for Google | 37 | 43 | 79 | 1m+ | | | Input is not validated |
| #9984 | Maintenance | 99 | 3 | 0 | 1m+ | | | strip tags strip tags |
| #9985 | One Click Demo Import | 38 | 22 | 84 | 1m+ | | | Non-prefixed global variable |
| #9986 | ManageWP Worker | 22 | 507 | 565 | 1m+ | | | Non-prefixed class |
| #9987 | WP-Optimize – Cache, Compress images, Minify & Clean database to boost page speed & performance | 56 | 5 | 769 | 1m+ | | | Non-prefixed global variable |
| #9988 | Popup Builder & Popup Maker for WordPress – OptinMonster Email Marketing and Lead Generation | 32 | 462 | 41 | 1m+ | | | Text Domain Mismatch |
| #9989 | Spectra Gutenberg Blocks – Website Builder for the Block Editor | 25 | 253 | 3,227 | 1m+ | | | Non-prefixed global variable |
| #9990 | Custom Post Type UI | 53 | 16 | 23 | 1m+ | | | Output is not escaped |
| #9991 | SVG Support | 97 | 1 | 27 | 1m+ | | | Non-prefixed global variable |
| #9992 | WP Fastest Cache – WordPress Cache Plugin | 24 | 541 | 753 | 1m+ | | | Unsafe printing function |
| #9993 | Complianz – GDPR/CCPA Cookie Consent | 24 | 487 | 403 | 1m+ | | | Missing Arg Domain |
| #9994 | File Manager | 22 | 740 | 520 | 1m+ | | | Unsafe printing function |
| #9995 | Loginizer | 25 | 814 | 504 | 1m+ | | | Output is not escaped |
| #9996 | Code Snippets | 36 | 34 | 203 | 1m+ | | | Nonce verification recommended |
| #9997 | Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More | 21 | 2,572 | 1,277 | 1m+ | | | Output is not escaped |
| #9998 | CookieYes – Cookie Banner for Cookie Consent (Easy to setup GDPR/CCPA Compliant Cookie Notice) | 87 | 1 | 291 | 1m+ | | | Non-prefixed global variable |
| #9999 | WP Super Cache | 25 | 800 | 989 | 1m+ | | | Output is not escaped |
| #10000 | Disable Comments – Remove Comments & Stop Spam [Multi-Site Support] | 53 | 15 | 46 | 1m+ | | | Non-prefixed global variable |