| #2851 | POEditor | 37 | 78 | 140 | 500 | | | Output is not escaped |
| #2852 | HAL | 58 | 106 | 24 | 500 | | | Text Domain Mismatch |
| #2853 | Edit Lock | 41 | 47 | 22 | 500 | | | Non Singular String Literal Domain |
| #2854 | Progress Bars | 81 | 15 | 14 | 500 | | | file system operations mkdir |
| #2855 | Slide-out Menu – Mobile Friendly modern navigation | 87 | 5 | 22 | 500 | | | Non-prefixed global variable |
| #2856 | Unlimited Logo Carousel | 40 | 286 | 15 | 500 | | | Text Domain Mismatch |
| #2857 | Kitgenix CAPTCHA for Cloudflare Turnstile | 100 | | 0 | 600 | | | No open findings |
| #2858 | TP PieBuilder | 80 | 9 | 7 | 500 | | | Output is not escaped |
| #2859 | Gist All-In-One Marketing – Live Chat, Popups, Email | 69 | 24 | 11 | 500 | | | Output is not escaped |
| #2860 | PE Panels | 43 | 181 | 4 | 500 | | | Output is not escaped |
| #2861 | Send From | 64 | 5 | 18 | 500 | | | Input is not sanitized |
| #2862 | Helio Pay (Accept 1-click crypto payments #USDC #SOL #BTC #ETH) | 91 | 8 | 11 | 500 | | | Missing direct file access protection |
| #2863 | Dashboard Wordcount | 72 | 30 | 7 | 500 | | | Output is not escaped |
| #2864 | Query Loop Post Selector | 98 | 3 | 1 | 600 | | | invalid tested upto minor |
| #2865 | Post Affiliate Pro | 24 | 293 | 335 | 500 | | | Nonce verification recommended |
| #2866 | BrightEdge Autopilot | 30 | 108 | 31 | 500 | | | curl curl setopt |
| #2867 | Email Post Changes | 63 | 43 | 8 | 500 | | | Missing Arg Domain |
| #2868 | Fygaro WC Plugin | 79 | 38 | 6 | 600 | | | Text Domain Mismatch |
| #2869 | Amedea – Unique Design Elements for Elementor | 89 | 1 | 25 | 500 | | | Mixed line endings |
| #2870 | Stick My Header for Astra | 98 | 2 | 3 | 600 | | | Non-prefixed global variable |
| #2871 | Block Editor: Reverse Columns on Mobile | 100 | | 0 | 600 | | | No open findings |
| #2872 | Friends Link Widget | 49 | 86 | 1 | 500 | | | Output is not escaped |
| #2873 | Certify – Certificate Management & Verification | 94 | 2 | 2 | 500 | | | Database parameter is not escaped |
| #2874 | Password Passthrough | 94 | 2 | 3 | 500 | | | Nonce verification recommended |
| #2875 | MetalpriceAPI | 97 | 4 | 4 | 500 | | | Missing direct file access protection |
| #2876 | Broadly for WordPress | 64 | 18 | 5 | 500 | | | Unsafe printing function |
| #2877 | Widget Indicadores Económicos (Chile) | 36 | 53 | 20 | 500 | | | Output is not escaped |
| #2878 | Time Clock – A WordPress Employee & Volunteer Time Clock Plugin | 37 | 166 | 107 | 500 | | | Output is not escaped |
| #2879 | Simple Testimonials Showcase | 84 | 33 | 11 | 500 | | | Missing Translators Comment |
| #2880 | Force Admin Color Scheme | 99 | 1 | 1 | 500 | | | outdated tested upto header |
| #2881 | Allow Only 1 Product in Cart | 99 | 1 | 1 | 500 | | | mismatched plugin name |
| #2882 | Generic Elements | 88 | 1,922 | 140 | 500 | | | Text Domain Mismatch |
| #2883 | Bitrix24 | 65 | 28 | 10 | 500 | | | Text Domain Mismatch |
| #2884 | Wanderlust OCA para WooCommerce | 36 | 157 | 55 | 500 | | | Text Domain Mismatch |
| #2885 | Rate limiting for Contact Form 7 | 25 | 547 | 1,306 | 500 | | | Non-prefixed global variable |
| #2886 | Give – Cloudflare Turnstile | 35 | 3 | 2 | 600 | | | Hidden files included |
| #2887 | Ogp Plus | 99 | 1 | 6 | 600 | | | Non-prefixed global variable |
| #2888 | Pinterest Pinboard Widget | 46 | 54 | 4 | 500 | | | Output is not escaped |
| #2889 | F4 Post Tree | 25 | 536 | 1,332 | 500 | | | Non-prefixed global variable |
| #2890 | WPB Custom Tab Manager for WooCommerce – Add, Edit & Reorder Tabs | 42 | 95 | 32 | 500 | | | Output is not escaped |
| #2891 | Taxonomy Converter | 41 | 54 | 24 | 600 | | | Output is not escaped |
| #2892 | Disable File Editor | 97 | 3 | 2 | 500 | | | outdated tested upto header |
| #2893 | Dokan Menu Hider | 95 | 8 | 2 | 500 | | | Text Domain Mismatch |
| #2894 | PickPlugins Product Designer for WooCommerce | 46 | 14 | 123 | 500 | | | Missing nonce verification |
| #2895 | Admin Help Docs | 97 | 9 | 31 | 500 | | | Non-prefixed global variable |
| #2896 | UF Health Require Image Alt Tags | 98 | 3 | 1 | 500 | | | Missing direct file access protection |
| #2897 | Remove Add to Cart Button for WooCommerce | 59 | 115 | 18 | 500 | | | Text Domain Mismatch |
| #2898 | Sitepact's Contact Form 7 Extension For Klaviyo | 24 | 541 | 1,412 | 500 | | | Non-prefixed global variable |
| #2899 | Add Google re captcha in WordPress Forms | 59 | 16 | 16 | 500 | | | Output is not escaped |
| #2900 | Shortcode | 94 | 6 | 45 | 500 | | | Direct Query |
