| #3501 | CRUDLab Disable Comments | 38 | 20 | 54 | 700 | | | Missing nonce verification |
| #3502 | One page checkout and layouts for woocommerce | 38 | 83 | 52 | 3k+ | | | Non-prefixed global variable |
| #3503 | Custom Menu Wizard Widget | 38 | 326 | 30 | 2k+ | | | Output is not escaped |
| #3504 | WP Page Templates | 38 | 92 | 28 | 400 | | | Non Singular String Literal Domain |
| #3505 | Custom post type templates for Elementor | 38 | 289 | 33 | 700 | | | Text Domain Mismatch |
| #3506 | Customize Posts | 38 | 31 | 77 | 1k+ | | | Non-prefixed hook name |
| #3507 | Login Page Customizer – Customize Login Screen & Branding | 38 | 36 | 172 | 1k+ | | | Non-prefixed function |
| #3508 | Darkify – Dark Mode & Night Mode for Website & Admin (Dark Theme Included) | 38 | 38 | 183 | 600 | | | Non-prefixed global variable |
| #3509 | Datafeedr Comparison Sets | 38 | 450 | 53 | 3k+ | | | Output is not escaped |
| #3510 | Datafeedr WooCommerce Importer | 38 | 112 | 56 | 5k+ | | | Text Domain Mismatch |
| #3511 | Availability Datepicker – Booking Calendar for Contact Form 7 – Input WP | 38 | 344 | 30 | 20k+ | | | Text Domain Mismatch |
| #3512 | Decent Comments | 38 | 93 | 28 | 2k+ | | | Output is not escaped |
| #3513 | Responsive Pricing Table | 38 | 309 | 105 | 10k+ | | | Non Singular String Literal Domain |
| #3514 | Product Badge, Label, Countdown Timer for WooCommerce – Sale Booster | 38 | 37 | 98 | 5k+ | | | Interpolated SQL is not prepared |
| #3515 | Easy WP Cleaner | 38 | 58 | 124 | 2k+ | | | Non-prefixed global variable |
| #3516 | Easy Yandex Metrica | 38 | 97 | 48 | 900 | | | Output is not escaped |
| #3517 | Elemailer Lite – Elementor email template & campaign builder | 38 | 44 | 50 | 5k+ | | | Output is not escaped |
| #3518 | Email Encoder – Protect Email Addresses and Phone Numbers | 38 | 9 | 150 | 90k+ | | | Non-prefixed global variable |
| #3519 | PiWeb Product Enquiry or product catalog for WooCommerce | 38 | 255 | 145 | 1k+ | | | Text Domain Mismatch |
| #3520 | Erident Custom Login and Dashboard | 38 | 122 | 28 | 8k+ | | | Unsafe printing function |
| #3521 | EU Cookie Law Compliance | 38 | 151 | 22 | 2k+ | | | Non Singular String Literal Domain |
| #3522 | Export to Blogger | 38 | 47 | 117 | 900 | | | Non-prefixed global variable |
| #3523 | Export User Data | 38 | 187 | 62 | 6k+ | | | Text Domain Mismatch |
| #3524 | Buttonizer – Social Media Share Buttons, Social Icons, & Social Feeds | 38 | 167 | 82 | 40k+ | | | Output is not escaped |
| #3525 | Social Photo Fetcher | 38 | 151 | 43 | 1k+ | | | Output is not escaped |
| #3526 | Social Shop for WooCommerce | 38 | 51 | 24 | 800 | | | Output is not escaped |
| #3527 | Responsive WordPress Slider – HG Slider | 38 | 67 | 75 | 7k+ | | | Missing nonce verification |
| #3528 | Flexy Breadcrumb | 38 | 241 | 13 | 20k+ | | | Output is not escaped |
| #3529 | Foyer – Digital Signage for WordPress | 38 | 148 | 191 | 1k+ | | | Non-prefixed global variable |
| #3530 | Front-end Editor | 38 | 78 | 62 | 500 | | | Output is not escaped |
| #3531 | Gecka Submenu | 38 | 326 | 36 | 3k+ | | | Output is not escaped |
| #3532 | GiveWP Donation Widgets for Elementor | 38 | 483 | 13 | 7k+ | | | Text Domain Mismatch |
| #3533 | Goal Tracker – Custom Event Tracking for GA4 | 38 | 541 | 25 | 2k+ | | | Output is not escaped |
| #3534 | GoDaddy Payments for WooCommerce | 38 | 58 | 65 | 2k+ | | | Output is not escaped |
| #3535 | GoodBarber | 38 | 38 | 73 | 1k+ | | | Nonce verification recommended |
| #3536 | GoUrl WooCommerce – Bitcoin Altcoin Payment Gateway Addon | 38 | 279 | 24 | 600 | | | Non Singular String Literal Domain |
| #3537 | Great Caroussel | 38 | 60 | 131 | 500 | | | SQL query is not prepared |
| #3538 | Greek Multi Tool – Greeklish Slugs, Permalinks & Transliteration | 38 | 160 | 82 | 1k+ | | | Unsafe printing function |
| #3539 | HashThemes Demo Importer | 38 | 71 | 44 | 6k+ | | | Output is not escaped |
| #3540 | CAOS | Host Google Analytics Locally | 38 | 124 | 44 | 10k+ | | | Output is not escaped |
| #3541 | WP Team – WordPress Team Member Plugin | 38 | 537 | 36 | 500 | | | Text Domain Mismatch |
| #3542 | Icegram Mailer – Reliable Email Deliverability, No-code SMTP Replacement & Email logs | 38 | 36 | 106 | 2k+ | | | Non-prefixed global variable |
| #3543 | Illdy Companion | 38 | 187 | 23 | 6k+ | | | Output is not escaped |
| #3544 | ThumbPress – Compress Images, Manage Thumbnails, Detect Image Issues, WebP/AVIF, Lazy Loading, Hotlinking & More | 38 | 21 | 88 | 30k+ | | | Direct Query |
| #3545 | imoje | 38 | 62 | 160 | 2k+ | | | Nonce verification recommended |
| #3546 | Import to Photo Gallery from NextGen gallery | 38 | 80 | 83 | 400 | | | Direct Query |
| #3547 | Coding Chicken – JetEngine Importer | 38 | 55 | 29 | 400 | | | Missing direct file access protection |
| #3548 | Insert PHP Code Snippet | 38 | 164 | 227 | 90k+ | | | Output is not escaped |
| #3549 | 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery | 38 | 353 | 77 | 80k+ | | | Non Singular String Literal Domain |
| #3550 | JC Submenu | 38 | 279 | 32 | 4k+ | | | Output is not escaped |