| #2901 | WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets | 35 | 35 | 22 | 100k+ | | | Missing direct file access protection |
| #2902 | WP API Menus | 35 | 12 | 9 | 2k+ | | | wp function not compatible with requires wp |
| #2903 | WP Associate Post R2 | 35 | 259 | 86 | 3k+ | | | Output is not escaped |
| #2904 | Bitly's WordPress Plugin | 35 | 6 | 23 | 2k+ | | | Non-prefixed function |
| #2905 | WP Cassify | 35 | 106 | 143 | 700 | | | Missing nonce verification |
| #2906 | Category Dropdown by GCS Design | 35 | 93 | 52 | 1k+ | | | Output is not escaped |
| #2907 | WP Change Email Sender | 35 | 5 | 13 | 10k+ | | | Non-prefixed namespace |
| #2908 | WP Compiler | 35 | 33 | 20 | 1k+ | | | Output is not escaped |
| #2909 | WP Content Copy Protection | 35 | 76 | 11 | 10k+ | | | Text Domain Mismatch |
| #2910 | Countdown Block | 35 | 5 | 2 | 1k+ | | | Hidden files included |
| #2911 | WP-Cron Status Checker | 35 | 240 | 111 | 5k+ | | | Text Domain Mismatch |
| #2912 | Custom Body Class | 35 | 39 | 101 | 10k+ | | | Non-prefixed global variable |
| #2913 | WP Dark Mode – Improve Accessibility with AI Powered Dark Theme | 35 | 20 | 160 | 20k+ | | | Non-prefixed global variable |
| #2914 | WP Datepicker | 35 | 225 | 181 | 7k+ | | | Output is not escaped |
| #2915 | Database Backup for WordPress | 35 | 128 | 88 | 70k+ | | | Output is not escaped |
| #2916 | WP Duplicate Page | 35 | 44 | 50 | 60k+ | | | Text Domain Mismatch |
| #2917 | WP Flexslider | 35 | 15 | 7 | 600 | | | Unsafe printing function |
| #2918 | WP Geo | 35 | 180 | 84 | 900 | | | Output is not escaped |
| #2919 | Auto Publish for Google My Business | 35 | 216 | 192 | 10k+ | | | Input is not validated |
| #2920 | WP GPX Maps | 35 | 27 | 100 | 4k+ | | | Non-prefixed global variable |
| #2921 | WPGraphQL | 35 | 10 | 86 | 30k+ | | | Non-prefixed hook name |
| #2922 | WP Hydra | 35 | 10 | 18 | 1k+ | | | Input is not sanitized |
| #2923 | WP-KaTeX | 35 | 14 | 8 | 800 | | | Missing direct file access protection |
| #2924 | WP-LESS | 35 | 16 | 8 | 10k+ | | | Missing direct file access protection |
| #2925 | WP Login and Logout Redirect | 35 | 16 | 6 | 6k+ | | | Text Domain Mismatch |
| #2926 | Mail logging – WP Mail Catcher | 35 | 232 | 157 | 20k+ | | | Text Domain Mismatch |
| #2927 | WP Mailto Links – Protect Email Addresses | 35 | 95 | 69 | 8k+ | | | Output is not escaped |
| #2928 | WP-Markdown | 35 | 31 | 39 | 400 | | | Output is not escaped |
| #2929 | WP Menu Custom Fields | 35 | 11 | 6 | 600 | | | Hidden files included |
| #2930 | WP Instant Feeds | 35 | 19 | 12 | 6k+ | | | Output is not escaped |
| #2931 | Disable Bulk Smush Limit of Smush Image Optimization | 35 | 3 | 2 | 3k+ | | | Hidden files included |
| #2932 | WP Open Street Map | 35 | 59 | 111 | 3k+ | | | Input is not validated |
| #2933 | WP-PageNavi | 35 | 84 | 95 | 500k+ | | | Non Singular String Literal Domain |
| #2934 | WP-Paginate | 35 | 37 | 55 | 20k+ | | | Input is not validated |
| #2935 | Parse.ly | 35 | 15 | 44 | 1k+ | | | Non-prefixed hook name |
| #2936 | WP-Persian | 35 | 144 | 37 | 7k+ | | | Unsafe printing function |
| #2937 | WP PGP Encrypted Emails | 35 | 63 | 39 | 400 | | | Output is not escaped |
| #2938 | WP Post Nav | 35 | 73 | 242 | 400 | | | Non-prefixed global variable |
| #2939 | WP Post Series | 35 | 10 | 9 | 600 | | | Non-prefixed global variable |
| #2940 | WP-PostViews | 35 | 132 | 64 | 100k+ | | | Unsafe printing function |
| #2941 | WP-Print | 35 | 110 | 52 | 8k+ | | | Unsafe printing function |
| #2942 | WP All Import – Property Import for WP Residence | 35 | 41 | 32 | 700 | | | Output is not escaped |
| #2943 | video carousel slider with lightbox | 35 | 350 | 136 | 1k+ | | | Output is not escaped |
| #2944 | WP Site Verification tool | 35 | 34 | 37 | 1k+ | | | Non-prefixed global variable |
| #2945 | WP Spam Question Filter | 35 | 63 | 30 | 2k+ | | | Output is not escaped |
| #2946 | Subresource Integrity (SRI) Manager | 35 | 26 | 94 | 900 | | | Request data is not unslashed |
| #2947 | WP Store Locator | 35 | 26 | 14 | 50k+ | | | wp function not compatible with requires wp |
| #2948 | WP System Information | 35 | 237 | 30 | 700 | | | Text Domain Mismatch |
| #2949 | WP To Top | 35 | 30 | 29 | 1k+ | | | Non-prefixed global variable |
| #2950 | WP Updates Notifier | 35 | 23 | 4 | 30k+ | | | Missing Translators Comment |