| #2501 | Flexible Refund for WooCommerce – EU One Click Return | 35 | 5 | 8 | 2k+ | | | Non-prefixed global variable |
| #2502 | Flexible Subscriptions | 35 | 46 | 249 | 1k+ | | | Non-prefixed global variable |
| #2503 | Flying Analytics: Self-Host Google Analytics v4 with Speed Optimization | 35 | 17 | 13 | 4k+ | | | Missing direct file access protection |
| #2504 | Flying Fonts: Remove Google Fonts & Use System Fonts for Faster Performance | 35 | 3 | 1 | 700 | | | Hidden files included |
| #2505 | Events Calendar by FooEvents | 35 | 57 | 59 | 4k+ | | | Non-prefixed global variable |
| #2506 | FooGallery Migrate | 35 | 41 | 232 | 1k+ | | | Non-prefixed global variable |
| #2507 | Force Email Login | 35 | 5 | 0 | 800 | | | Hidden files included |
| #2508 | Force Regenerate Thumbnails | 35 | 12 | 17 | 200k+ | | | unlink unlink |
| #2509 | Force Reinstall | 35 | 118 | 34 | 2k+ | | | Output is not escaped |
| #2510 | Form Input Masks For Elementor Forms | 35 | 3 | 1 | 10k+ | | | Hidden files included |
| #2511 | Friendly Captcha for WordPress | 35 | 192 | 62 | 9k+ | | | Output is not escaped |
| #2512 | FrontBlocks for Gutenberg/GeneratePress | 35 | 10 | 7 | 500 | | | Offloaded Content |
| #2513 | Frontend Reset Password | 35 | 83 | 128 | 10k+ | | | Text Domain Mismatch |
| #2514 | Full Width Banner Slider Wp | 35 | 239 | 140 | 2k+ | | | Output is not escaped |
| #2515 | g-FFL Cockpit | 35 | 18 | 224 | 500 | | | Direct Query |
| #2516 | GA4WP – Analytics Dashboard for the Website | 35 | 434 | 157 | 2k+ | | | Text Domain Mismatch |
| #2517 | Video Gallery – YouTube Gallery, Vimeo, Video Portfolio, Image Portfolio and Image Gallery | 35 | 50 | 199 | 10k+ | | | Non-prefixed global variable |
| #2518 | GD bbPress Attachments | 35 | 2 | 10 | 6k+ | | | wp redirect wp redirect |
| #2519 | GDPR Compliance & Cookie Consent | 35 | 251 | 61 | 4k+ | | | Output is not escaped |
| #2520 | Genesis Simple Sidebars | 35 | 9 | 51 | 10k+ | | | Nonce verification recommended |
| #2521 | GeoTargeting Lite – WordPress Geolocation | 35 | 66 | 79 | 1k+ | | | Output is not escaped |
| #2522 | Get a Newsletter | 35 | 138 | 144 | 400 | | | Output is not escaped |
| #2523 | Give – Cloudflare Turnstile | 35 | 3 | 2 | 600 | | | Hidden files included |
| #2524 | Give – Divi Donation Modules | 35 | 286 | 12 | 600 | | | Text Domain Mismatch |
| #2525 | Glossary | 35 | 169 | 93 | 2k+ | | | Non Singular String Literal Domain |
| #2526 | GLS Shipping for WooCommerce | 35 | 2 | 0 | 2k+ | | | Hidden files included |
| #2527 | GNU Terry Pratchett | 35 | 2 | 1 | 1k+ | | | Hidden files included |
| #2528 | Google Analytics Opt-Out | 35 | 34 | 7 | 5k+ | | | Output is not escaped |
| #2529 | Reviews Block for Google | 35 | 244 | 35 | 1k+ | | | Missing Arg Domain |
| #2530 | Gravitec.net – Web Push Notifications | 35 | 47 | 52 | 1k+ | | | wp function not compatible with requires wp |
| #2531 | Gravity Forms: Multiple Form Instances | 35 | 6 | 6 | 700 | | | Hidden files included |
| #2532 | Groups | 35 | 1 | 1 | 10k+ | | | Hidden files included |
| #2533 | Gum Addon for Elementor | 35 | 660 | 72 | 50k+ | | | Text Domain Mismatch |
| #2534 | Gumlet – Image optimization with Resize, Compression, Lazy load, Caching & CDN delivery | 35 | 53 | 45 | 500 | | | parse url parse url |
| #2535 | Health Check & Troubleshooting | 35 | 264 | 238 | 300k+ | | | Missing Arg Domain |
| #2536 | Heartbeat Control | 35 | 27 | 18 | 80k+ | | | Missing Arg Domain |
| #2537 | Social Comments by Heateor | 35 | 285 | 35 | 700 | | | Unsafe printing function |
| #2538 | Help Scout | 35 | 11 | 13 | 400 | | | Missing direct file access protection |
| #2539 | Highlighting Code Block | 35 | 6 | 2 | 10k+ | | | Hidden files included |
| #2540 | Hippoo Mobile App for WooCommerce | 35 | 5 | 92 | 1k+ | | | Direct Query |
| #2541 | HivePress – Business Directory, Listings & Classified Ads Plugin | 35 | 38 | 180 | 10k+ | | | Direct Query |
| #2542 | HookMeUp for WooCommerce | 35 | 59 | 29 | 10k+ | | | Output is not escaped |
| #2543 | HT Form Widget for Elementor and WPForms | 35 | 8 | 9 | 2k+ | | | Output is not escaped |
| #2544 | HTTP Authentication | 35 | 23 | 6 | 600 | | | Output is not escaped |
| #2545 | Hyve Lite – AI Chatbot, ChatGPT-Powered Conversational Support | 35 | 1 | 40 | 7k+ | | | Direct Query |
| #2546 | Iframely – WP media embeds, cards and blocks | 35 | 136 | 43 | 2k+ | | | Unsafe printing function |
| #2547 | PDF Compressor & Watermark – iLovePDF | 35 | 216 | 5 | 600 | | | Text Domain Mismatch |
| #2548 | Image Slider | 35 | 192 | 95 | 4k+ | | | Output is not escaped |
| #2549 | Image Watermark | 35 | 85 | 181 | 40k+ | | | Missing nonce verification |
| #2550 | Image Widget | 35 | 165 | 31 | 100k+ | | | Output is not escaped |