| #2601 | Mail Queue | 35 | 25 | 103 | 1k+ | | | Nonce verification recommended |
| #2602 | Maintenance Switch | 35 | 12 | 59 | 600 | | | Non-prefixed function |
| #2603 | MainWP Child Reports | 35 | 49 | 116 | 100k+ | | | Non-prefixed hook name |
| #2604 | Map Block for Google Maps | 35 | 6 | 5 | 20k+ | | | Hidden files included |
| #2605 | Mark Posts | 35 | 30 | 34 | 1k+ | | | Output is not escaped |
| #2606 | Marquee image crawler | 35 | 168 | 136 | 700 | | | Non-prefixed global variable |
| #2607 | MathML Block | 35 | 10 | 2 | 1k+ | | | Hidden files included |
| #2608 | Mechanic Visitor Counter | 35 | 240 | 66 | 7k+ | | | Output is not escaped |
| #2609 | Media Credit | 35 | 28 | 35 | 1k+ | | | Non-prefixed global variable |
| #2610 | Media Library Downloader | 35 | 21 | 16 | 4k+ | | | Output is not escaped |
| #2611 | MeetingHub – Webinar & Meeting Plugin for Zoom, Google Meet, Webex, Microsoft Teams, & Jitsi Meet | 35 | 37 | 313 | 400 | | | Non-prefixed global variable |
| #2612 | Menu Item Duplicator | 35 | 3 | 0 | 2k+ | | | Hidden files included |
| #2613 | Restaurant Menu – Food Ordering System – Table Reservation | 35 | 317 | 186 | 8k+ | | | Unsafe printing function |
| #2614 | Metadata Viewer | 35 | 2 | 11 | 400 | | | Non-prefixed global variable |
| #2615 | Mighty Pros & Cons | 35 | 12 | 6 | 800 | | | Text Domain Mismatch |
| #2616 | Mini Ajax Cart for WooCommerce | 35 | 297 | 240 | 900 | | | Text Domain Mismatch |
| #2617 | Mini Cart for WooCommerce – Add a Stylish Sliding Cart | 35 | 42 | 160 | 600 | | | Non-prefixed global variable |
| #2618 | SAML IDP (Identity Provider) – Login with Website Users | 35 | 13 | 326 | 600 | | | Non-prefixed global variable |
| #2619 | Modal Guten Block | 35 | 6 | 3 | 2k+ | | | Hidden files included |
| #2620 | Modern Images WP | 35 | 10 | 3 | 400 | | | Missing Translators Comment |
| #2621 | MONEI Payments for WooCommerce | 35 | 15 | 65 | 500 | | | Non-prefixed hook name |
| #2622 | More Widgets | 35 | 55 | 15 | 1k+ | | | Output is not escaped |
| #2623 | mosparo Integration | 35 | 114 | 301 | 900 | | | Missing nonce verification |
| #2624 | AI Product Search for WooCommerce – Motive Commerce Search | 35 | 70 | 82 | 400 | | | Missing direct file access protection |
| #2625 | Movylo Marketing Automation | 35 | 38 | 88 | 700 | | | error log print r |
| #2626 | MotoPress Hotel Booking Styles & Templates | 35 | 37 | 19 | 10k+ | | | block api version too low |
| #2627 | Hide from Search | 35 | 5 | 8 | 3k+ | | | Missing direct file access protection |
| #2628 | Image Refresh | 35 | 4 | 6 | 900 | | | Dynamic hook name |
| #2629 | My Eyes Are Up Here | 35 | 7 | 12 | 2k+ | | | Missing nonce verification |
| #2630 | myPOS Checkout | 35 | 151 | 8 | 4k+ | | | Text Domain Mismatch |
| #2631 | Never Let Me Go | 35 | 34 | 47 | 400 | | | Non-prefixed global variable |
| #2632 | NewsPlugin | 35 | 84 | 53 | 400 | | | Text Domain Mismatch |
| #2633 | NGG Smart Image Search | 35 | 298 | 155 | 400 | | | Output is not escaped |
| #2634 | Nginx Cache Controller | 35 | 79 | 96 | 1k+ | | | Text Domain Mismatch |
| #2635 | Ni WooCommerce Sales Report | 35 | 236 | 256 | 500 | | | Text Domain Mismatch |
| #2636 | Nooz | 35 | 287 | 108 | 500 | | | Text Domain Mismatch |
| #2637 | Noted! | 35 | 5 | 22 | 1k+ | | | Non-prefixed global variable |
| #2638 | NS Cloner – Site Cloner and Multisite Duplicator | 35 | 29 | 16 | 7k+ | | | Missing direct file access protection |
| #2639 | Meta pixel for WordPress | 35 | 90 | 40 | 400k+ | | | Exception output is not escaped |
| #2640 | Fonts Plugin | Google Fonts, Adobe Fonts & Upload Fonts | 35 | 41 | 8 | 200k+ | | | Missing direct file access protection |
| #2641 | Newsletters, Email Marketing, SMS and Popups by Omnisend | 35 | 4 | 2 | 100k+ | | | Hidden files included |
| #2642 | Email Marketing for WooCommerce by Omnisend | 35 | 12 | 21 | 40k+ | | | Non-prefixed function |
| #2643 | One Page Express Companion | 35 | 132 | 65 | 10k+ | | | Output is not escaped |
| #2644 | ONet Regenerate Thumbnails | 35 | 190 | 64 | 1k+ | | | Text Domain Mismatch |
| #2645 | Plugin Ongkos Kirim JNE Tiki Sicepat Wahana J&T POS for Woocommerce | 35 | 117 | 144 | 2k+ | | | Output is not escaped |
| #2646 | Out of the Block: OpenStreetMap | 35 | 9 | 4 | 700 | | | Missing direct file access protection |
| #2647 | OPcache Manager | 35 | 155 | 75 | 1k+ | | | Output is not escaped |
| #2648 | OPcache Reset | 35 | 9 | 7 | 400 | | | Non-prefixed function |
| #2649 | Order Delivery Date for WooCommerce | 35 | 2,075 | 73 | 10k+ | | | wp function not compatible with requires wp |
| #2650 | Orderable – Restaurant & Food Ordering System | 35 | 12 | 324 | 5k+ | | | Non-prefixed global variable |