| #2651 | OSM Map Widget for Elementor | 35 | 183 | 14 | 9k+ | | | Text Domain Mismatch |
| #2652 | OT Flatsome Vertical Menu | 35 | 126 | 26 | 10k+ | | | Text Domain Mismatch |
| #2653 | OtFm Gutenberg Spoiler – (or FAQ) collapse block | 35 | 6 | 9 | 600 | | | trademarked term |
| #2654 | Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE | 35 | 131 | 41 | 300k+ | | | Missing direct file access protection |
| #2655 | Page Optimize | 35 | 70 | 41 | 200k+ | | | Non Singular String Literal Domain |
| #2656 | Page Visits Counter – Lite | 35 | 28 | 35 | 5k+ | | | Output is not escaped |
| #2657 | Paybox WooCommerce Payment Gateway | 35 | 165 | 88 | 500 | | | Non Singular String Literal Domain |
| #2658 | Paytm Payment Gateway | 35 | 92 | 104 | 3k+ | | | Missing Arg Domain |
| #2659 | Paytrail for WooCommerce | 35 | 28 | 46 | 3k+ | | | Non-prefixed global variable |
| #2660 | Pearl – Header Builder | 35 | 7 | 283 | 5k+ | | | Non-prefixed global variable |
| #2661 | Perfecty Push Notifications | 35 | 204 | 213 | 4k+ | | | SQL query is not prepared |
| #2662 | Permissions Editor for Ninja Forms | 35 | 29 | 6 | 1k+ | | | Output is not escaped |
| #2663 | Phone Orders for WooCommerce | 35 | 1 | 229 | 1k+ | | | Non-prefixed hook name |
| #2664 | Pie Calendar – Events Calendar Made Simple | 35 | 83 | 53 | 1k+ | | | Text Domain Mismatch |
| #2665 | Piwik PRO | 35 | 22 | 3 | 3k+ | | | Output is not escaped |
| #2666 | Pixeline's Email Protector | 35 | 77 | 5 | 800 | | | Unsafe printing function |
| #2667 | Planyo online reservation system | 35 | 64 | 90 | 400 | | | Output is not escaped |
| #2668 | Plausible Analytics | 35 | 244 | 61 | 10k+ | | | Exception output is not escaped |
| #2669 | Accept Cryptocurrencies with Plisio | 35 | 37 | 47 | 1k+ | | | Text Domain Mismatch |
| #2670 | Pochipp | 35 | 27 | 102 | 20k+ | | | Non-prefixed global variable |
| #2671 | Pods Alternative Cache | 35 | 1 | 0 | 5k+ | | | Hidden files included |
| #2672 | Poptin – Email Marketing Automation, Newsletter & Exit Pop Ups, Email Popups | 35 | 168 | 29 | 20k+ | | | Output is not escaped |
| #2673 | Popular Posts | 35 | 166 | 71 | 900 | | | Unsafe printing function |
| #2674 | Popup with fancybox | 35 | 196 | 168 | 900 | | | Unsafe printing function |
| #2675 | Post Content Shortcodes | 35 | 205 | 56 | 2k+ | | | Output is not escaped |
| #2676 | Post Draft Preview | 35 | 49 | 69 | 700 | | | Text Domain Mismatch |
| #2677 | Post List Featured Image | 35 | 112 | 100 | 900 | | | Output is not escaped |
| #2678 | Post Meta Data Manager | 35 | 30 | 112 | 1k+ | | | Non-prefixed global variable |
| #2679 | Post Password Token | 35 | 132 | 38 | 600 | | | Text Domain Mismatch |
| #2680 | Posts Table with Search & Sort | 35 | 143 | 33 | 3k+ | | | Text Domain Mismatch |
| #2681 | PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) | 35 | 6 | 56 | 80k+ | | | Post Not In exclude |
| #2682 | Powerful Posts Per Page (PPPP) | 35 | 4 | 1 | 1k+ | | | Hidden files included |
| #2683 | Pre-Publish Checklist | 35 | 7 | 2 | 1k+ | | | Missing direct file access protection |
| #2684 | Presto Player | 35 | 37 | 78 | 100k+ | | | Missing Arg Domain |
| #2685 | PrettyLinks – Affiliate Link Management, URL Shortener, Link Cloaking, Tracking & Branded Short Links | 35 | 1 | 5 | 200k+ | | | Database parameter is not escaped |
| #2686 | Product Prices by User Roles for WooCommerce | 35 | 12 | 19 | 1k+ | | | Non-prefixed hook name |
| #2687 | Print, PDF & Email by PrintFriendly | 35 | 1 | 5 | 20k+ | | | Not In Footer |
| #2688 | Product Blocks for WooCommerce | 35 | 4 | 3 | 4k+ | | | slow db query tax query |
| #2689 | Product Delivery Date for WooCommerce – Lite | 35 | 171 | 27 | 1k+ | | | Text Domain Mismatch |
| #2690 | Product Input Fields for WooCommerce | 35 | 18 | 84 | 4k+ | | | Non-prefixed function |
| #2691 | Min Max Step Quantity Limits Manager for WooCommerce | 35 | 67 | 158 | 3k+ | | | Non-prefixed global variable |
| #2692 | Ninjalytics: Sales Reports & Order Export for WooCommerce and EDD | 35 | 6 | 32 | 6k+ | | | Non-prefixed global variable |
| #2693 | Pronamic Client | 35 | 111 | 48 | 700 | | | Output is not escaped |
| #2694 | Protect the Children! | 35 | 2 | 34 | 1k+ | | | Missing nonce verification |
| #2695 | Publitio | 35 | 47 | 26 | 400 | | | curl curl setopt |
| #2696 | Push Notifications by LaraPush | 35 | 32 | 76 | 5k+ | | | Non-prefixed global variable |
| #2697 | Push7 | 35 | 45 | 17 | 700 | | | Short PHP open tag found |
| #2698 | QuickWebP – Compress / Optimize Images & Convert WebP | SEO Friendly | 35 | 225 | 110 | 8k+ | | | Non Singular String Literal Domain |
| #2699 | Quran multilanguage Text & Audio | 35 | 177 | 166 | 500 | | | Output is not escaped |
| #2700 | Random Post on Refresh | 35 | 3 | 8 | 500 | | | Non-prefixed hook name |