| #4901 | Razorpay Payment Button Elementor Plugin | 20 | 479 | 62 | 1k+ | | | Exception output is not escaped |
| #4902 | Automatic image ALT attributes | 98 | 4 | 0 | 1k+ | | | Missing direct file access protection |
| #4903 | Clio Grow Form | 91 | 179 | 19 | 1k+ | | | Text Domain Mismatch |
| #4904 | Download Media Library | 49 | 22 | 40 | 1k+ | | | Text Domain Mismatch |
| #4905 | PhotoSwipe | 92 | 4 | 9 | 1k+ | | | Not In Footer |
| #4906 | Smart Maintenance Mode | 38 | 137 | 128 | 1k+ | | | Output is not escaped |
| #4907 | WC Builder – WooCommerce Page Builder for WPBakery | 36 | 647 | 50 | 1k+ | | | Text Domain Mismatch |
| #4908 | EasyFonts – Host Google Fonts Locally, Fast & Auto-Optimize, GDPR Compliant | 47 | 5 | 58 | 1k+ | | | Interpolated SQL is not prepared |
| #4909 | WPBakery Page Builder Simple All Responsive | 88 | 4 | 6 | 1k+ | | | Missing direct file access protection |
| #4910 | MomentoPress for Momento360 | 98 | 2 | 3 | 1k+ | | | Missing Version |
| #4911 | Bradmax Player | 99 | 1 | 0 | 1k+ | | | outdated tested upto header |
| #4912 | Tutor LMS – Migration Tool | 27 | 139 | 341 | 1k+ | | | Direct Query |
| #4913 | AffiliateWP – Leaderboard | 49 | 68 | 13 | 1k+ | | | Output is not escaped |
| #4914 | HTTP Security Header | 99 | 1 | 1 | 1k+ | | | Discouraged text-domain loading |
| #4915 | Accordion Slider Gallery | 29 | 379 | 142 | 1k+ | | | Text Domain Mismatch |
| #4916 | Related Products Manager for WooCommerce | 79 | 9 | 43 | 1k+ | | | Non-prefixed global variable |
| #4917 | Phone Orders for WooCommerce | 35 | 1 | 229 | 1k+ | | | Non-prefixed hook name |
| #4918 | wp-cleanumlauts2 | 61 | 32 | 22 | 1k+ | | | Output is not escaped |
| #4919 | Advanced Custom Fields: Ninjaforms Add-on | 76 | 43 | 8 | 1k+ | | | Text Domain Mismatch |
| #4920 | StreamWeasels Twitch Integration | 23 | 555 | 1,465 | 1k+ | | | Non-prefixed global variable |
| #4921 | Export Plugins and Templates | 30 | 143 | 33 | 1k+ | | | file system operations fread |
| #4922 | Fake Pay For WooCommerce | 97 | 13 | 1 | 1k+ | | | Text Domain Mismatch |
| #4923 | Sch.gr Commons | 94 | 6 | 5 | 1k+ | | | Discouraged text-domain loading |
| #4924 | Custom Product Tabs for WooCommerce WP All Import Add-on | 65 | 18 | 18 | 1k+ | | | Non-prefixed global variable |
| #4925 | Section Builder with Backgrounds – Customize with Color, Gradient, Image and Parallax. | 93 | 2 | 7 | 1k+ | | | Non-prefixed global variable |
| #4926 | Tumult Hype Animations | 32 | 56 | 117 | 1k+ | | | Output is not escaped |
| #4927 | PO/MO Editor | 39 | 106 | 45 | 1k+ | | | Unsafe printing function |
| #4928 | Menu By User Roles | 99 | 1 | 1 | 1k+ | | | Non-prefixed constant |
| #4929 | Spam Comments Cleaner | 62 | 14 | 29 | 1k+ | | | Non-prefixed function |
| #4930 | Remove Site Health From Dashboard | 99 | 1 | 0 | 1k+ | | | outdated tested upto header |
| #4931 | Newsletter Subscription Form – User Subscriptions Form, Capture Email | 24 | 385 | 829 | 1k+ | | | Non-prefixed global variable |
| #4932 | NS Category Widget | 88 | 1 | 17 | 1k+ | | | Missing nonce verification |
| #4933 | Affiliates WooCommerce Light | 99 | 1 | 3 | 1k+ | | | trademarked term |
| #4934 | Lili Business Banking | 98 | 18 | 0 | 1k+ | | | Text Domain Mismatch |
| #4935 | Resize images before upload | 54 | 19 | 5 | 1k+ | | | Output is not escaped |
| #4936 | Mizan Demo Importer | 39 | 31 | 91 | 1k+ | | | Missing nonce verification |
| #4937 | Benchmark Email Lite | 39 | 86 | 23 | 1k+ | | | Output is not escaped |
| #4938 | Authors Widget | 35 | 170 | 19 | 1k+ | | | Output is not escaped |
| #4939 | WP Nav Plus | 40 | 95 | 13 | 1k+ | | | Output is not escaped |
| #4940 | Easy Hide Admin Menu Items | 96 | 43 | 11 | 1k+ | | | Text Domain Mismatch |
| #4941 | Store file uploads for Contact Form 7 | 76 | 5 | 6 | 1k+ | | | Output is not escaped |
| #4942 | Encyclopedia / Glossary / Wiki | 37 | 263 | 48 | 1k+ | | | Output is not escaped |
| #4943 | 360 Javascript Viewer | 37 | 144 | 22 | 1k+ | | | Output is not escaped |
| #4944 | WP Counter Up – Animated Number Counter & Milestone Showcase | 51 | 18 | 239 | 1k+ | | | Non-prefixed global variable |
| #4945 | Easy Spam Filter – Privacy-Friendly CAPTCHA Alternative with Turnstile for Contact Form 7, WPForms, BuddyPress, Elementor | 97 | 2 | 14 | 1k+ | | | Dynamic hook name |
| #4946 | Comment Moderation/Notification Recipients | 98 | 2 | 7 | 1k+ | | | Non-prefixed global variable |
| #4947 | CRM Perks Integration for Gravity Forms and Salesforce | 32 | 807 | 178 | 1k+ | | | Text Domain Mismatch |
| #4948 | RCD-Right Click Disabler | 96 | 2 | 9 | 1k+ | | | Missing Version |
| #4949 | WP Image Size Selection | 98 | 3 | 2 | 1k+ | | | Missing direct file access protection |
| #4950 | BSK Forms Blacklist | 35 | 831 | 550 | 1k+ | | | Output is not escaped |