| #1951 | Activity Plus Reloaded for BuddyPress | 33 | 88 | 93 | 1k+ | | | Output is not escaped |
| #1952 | Five Star Business Profile and Schema | 33 | 289 | 138 | 7k+ | | | Output is not escaped |
| #1953 | Addi – Cuotas que se adaptan a ti | 33 | 106 | 209 | 2k+ | | | Direct Query |
| #1954 | Cargus | 33 | 48 | 64 | 700 | | | Input is not sanitized |
| #1955 | Nexi XPay | 33 | 496 | 277 | 6k+ | | | Text Domain Mismatch |
| #1956 | CartPops – High Converting Add To Cart Popup For WooCommerce | 33 | 63 | 188 | 4k+ | | | Non-prefixed global variable |
| #1957 | CB Custom Beaver Builder Modules | 33 | 748 | 4 | 1k+ | | | Output is not escaped |
| #1958 | Century ToolKit | 33 | 118 | 78 | 700 | | | Output is not escaped |
| #1959 | Chartify – WordPress Chart Plugin | 33 | 76 | 411 | 3k+ | | | Non-prefixed global variable |
| #1960 | Civic Cookie Control | 33 | 1,881 | 219 | 2k+ | | | Text Domain Mismatch |
| #1961 | Clicky Analytics | 33 | 166 | 92 | 10k+ | | | Output is not escaped |
| #1962 | Companion Auto Update | 33 | 159 | 298 | 40k+ | | | Direct Query |
| #1963 | Companion Sitemap Generator – Simple, Smart, and SEO-Ready | 33 | 118 | 57 | 7k+ | | | Missing Translators Comment |
| #1964 | Conekta Payment Gateway | 33 | 240 | 66 | 2k+ | | | Text Domain Mismatch |
| #1965 | Contact Form Block | 33 | 64 | 73 | 500 | | | Non Singular String Literal Domain |
| #1966 | Contact Form Plugin | 33 | 47 | 220 | 2k+ | | | Non-prefixed function |
| #1967 | Contact List – Online Staff Directory & Address Book | 33 | 118 | 342 | 1k+ | | | Nonce verification recommended |
| #1968 | Chatbot with IBM watsonx Assistant | 33 | 324 | 83 | 400 | | | Non Singular String Literal Domain |
| #1969 | Countdown Timer | 33 | 311 | 17 | 900 | | | Text Domain Mismatch |
| #1970 | Chwazi – Delivery & Pickup Scheduling for WooCommerce | 33 | 563 | 192 | 600 | | | Text Domain Mismatch |
| #1971 | Device Detector | 33 | 209 | 112 | 600 | | | Output is not escaped |
| #1972 | DJ-Accessibility – Accessibility Plugin | 33 | 370 | 48 | 3k+ | | | Text Domain Mismatch |
| #1973 | Easy Timer | 33 | 78 | 450 | 1k+ | | | Non-prefixed global variable |
| #1974 | Easy Upload Files During Checkout | 33 | 218 | 199 | 500 | | | Unsafe printing function |
| #1975 | EchBay Phonering Alo | 33 | 74 | 47 | 1k+ | | | Output is not escaped |
| #1976 | Echelon Widgets for SiteOrigin | 33 | 667 | 5 | 800 | | | Output is not escaped |
| #1977 | Human Presence – Stop Form Spam Without ReCaptcha | 33 | 54 | 65 | 1k+ | | | Request data is not unslashed |
| #1978 | Meta for WooCommerce | 33 | 68 | 189 | 400k+ | | | Non-prefixed hook name |
| #1979 | Fastly | 33 | 221 | 66 | 1k+ | | | Text Domain Mismatch |
| #1980 | FastPixel Cache – Optimize Page Speed: Compress Images, Minify, Clean Database & CDN | 33 | 52 | 342 | 4k+ | | | Request data is not unslashed |
| #1981 | Gallery Custom Links | 33 | 64 | 62 | 30k+ | | | Non Singular String Literal Domain |
| #1982 | GDPR Cookie Compliance – Cookie Banner, Cookie Consent, Cookie Notice for CCPA, EU Cookie Law | 33 | 48 | 370 | 300k+ | | | Non-prefixed global variable |
| #1983 | GetResponse Forms by Optin Cat | 33 | 68 | 138 | 1k+ | | | Missing direct file access protection |
| #1984 | WP GIF Uploader | 33 | 117 | 44 | 1k+ | | | Text Domain Mismatch |
| #1985 | Five Star Restaurant Reviews | 33 | 242 | 142 | 400 | | | Output is not escaped |
| #1986 | Comments – GraphComment | AI-Moderated Comment System | 33 | 196 | 177 | 400 | | | Unsafe printing function |
| #1987 | Gravity Forms Eway | 33 | 519 | 45 | 500 | | | Missing Translators Comment |
| #1988 | GSheetConnector for Forminator Forms | 33 | 128 | 201 | 1k+ | | | Non-prefixed global variable |
| #1989 | Ultimate Addons for Elementor | 33 | 81 | 291 | 2m+ | | | Non-prefixed class |
| #1990 | Mentions légales [FR] | 33 | 238 | 48 | 2k+ | | | Text Domain Mismatch |
| #1991 | HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce | 33 | 377 | 139 | 20k+ | | | Unsafe printing function |
| #1992 | Flipbox – Awesomes Flip Boxes Image Overlay | 33 | 400 | 7,279 | 10k+ | | | Input is not validated |
| #1993 | Image Source Control Lite – Show Image Credits and Captions | 33 | 140 | 221 | 3k+ | | | Non-prefixed hook name |
| #1994 | ImageLinks – Interactive Image Builder with Hotspots | 33 | 517 | 90 | 1k+ | | | Text Domain Mismatch |
| #1995 | Inactive User Deleter | 33 | 453 | 170 | 800 | | | Output is not escaped |
| #1996 | InPost Gallery | 33 | 105 | 245 | 700 | | | Non-prefixed global variable |
| #1997 | WPZOOM Social Feed Widget & Block | 33 | 310 | 278 | 60k+ | | | Unsafe printing function |
| #1998 | Intagrate Lite | 33 | 94 | 152 | 4k+ | | | date date |
| #1999 | IP2Location Redirection | 33 | 198 | 122 | 7k+ | | | Output is not escaped |
| #2000 | IssueM | 33 | 56 | 173 | 600 | | | Request data is not unslashed |