| #1 | Plugin Check (PCP) | 0 | 128 | 132 | 10k+ | | | Exception output is not escaped |
| #2 | Powered Cache – Caching and Optimization for WordPress – Easily Improve PageSpeed & Web Vitals Score | 20 | 147 | 231 | 3k+ | | | Exception output is not escaped |
| #3 | WebP Express | 21 | 160 | 427 | 300k+ | | | Non-prefixed global variable |
| #4 | WP Compress – Instant Performance & Speed Optimization | 21 | 3,367 | 3,253 | 10k+ | | | Non Singular String Literal Domain |
| #5 | Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer | 22 | 2,854 | 1,269 | 50k+ | | | Text Domain Mismatch |
| #6 | Code Profiler – WordPress Performance Profiling and Debugging Made Easy | 22 | 265 | 400 | 8k+ | | | Non-prefixed global variable |
| #7 | JCH Optimize | 22 | 1,145 | 136 | 4k+ | | | Output is not escaped |
| #8 | Jetpack – WP Security, Backup, Speed, & Growth | 22 | 2,975 | 1,348 | 3m+ | | | Text Domain Mismatch |
| #9 | PageSpeed Ninja – Cache, Minify, Defer CSS JavaScript, Critical CSS, Optimize Images, Convert WebP | 22 | 984 | 407 | 5k+ | | | Unsafe printing function |
| #10 | Seraphinite Accelerator | 22 | 595 | 255 | 50k+ | | | Output is not escaped |
| #11 | SNS Count Cache | 22 | 918 | 120 | 7k+ | | | Non Singular String Literal Domain |
| #12 | Swift Performance Lite | 22 | 2,346 | 1,325 | 6k+ | | | Text Domain Mismatch |
| #13 | 10Web Booster – Website speed optimization, Cache & Page Speed optimizer | 22 | 513 | 601 | 70k+ | | | Non-prefixed global variable |
| #14 | RapidLoad AI – Optimize Web Vitals Automatically | 22 | 81 | 840 | 700 | | | Nonce verification recommended |
| #15 | Autoptimize | 23 | 288 | 191 | 800k+ | | | Output is not escaped |
| #16 | NitroPack – Performance, Page Speed & Cache Plugin for Core Web Vitals, CDN & Image Optimization | 23 | 311 | 635 | 90k+ | | | Output is not escaped |
| #17 | W3 Total Cache | 23 | 307 | 678 | 900k+ | | | Non-prefixed global variable |
| #18 | ManageWP Worker | 23 | 506 | 565 | 1m+ | | | Non-prefixed class |
| #19 | Easy Optimizer – PageSpeed, Cache & Core Web Vitals (Unused CSS, Delay JS, Lazy Load) | 24 | 194 | 514 | 400 | | | Direct Query |
| #20 | F12 Profiler | 24 | 282 | 451 | 500 | | | Direct Query |
| #21 | Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN | 24 | 3,408 | 866 | 70k+ | | | Text Domain Mismatch |
| #22 | Servebolt Optimizer | 24 | 1,958 | 681 | 1k+ | | | Text Domain Mismatch |
| #23 | WP Fastest Cache – WordPress Cache Plugin | 24 | 541 | 753 | 1m+ | | | Unsafe printing function |
| #24 | WPSpeed – WordPress Speed, Cache & Performance Optimization (Core Web Vitals, PageSpeed 100) | 24 | 482 | 189 | 2k+ | | | Output is not escaped |
| #25 | AF Companion – Starter Sites, Speed Booster & Growth Suite for Professional Publishing | 25 | 665 | 1,486 | 10k+ | | | Non-prefixed global variable |
| #26 | Breeze Cache | 25 | 219 | 801 | 400k+ | | | Non-prefixed global variable |
| #27 | Docket Cache – Object Cache Accelerator | 25 | 333 | 481 | 20k+ | | | Output is not escaped |
| #28 | Index WP MySQL For Speed | 25 | 250 | 255 | 50k+ | | | Output is not escaped |
| #29 | BerqWP – All-In-One Optimization for Core Web Vitals, Cache, CDN, Images, CSS & JavaScript | 25 | 203 | 547 | 4k+ | | | Non-prefixed global variable |
| #30 | Simply Static – The Static Site Generator | 25 | 190 | 534 | 30k+ | | | Non-prefixed hook name |
| #31 | Super Page Cache – Cloudflare Cache, Page Speed & Core Web Vitals | 25 | 143 | 357 | 60k+ | | | Input is not sanitized |
| #32 | WP Super Cache | 25 | 800 | 989 | 1m+ | | | Output is not escaped |
| #33 | ezCache | 26 | 127 | 284 | 10k+ | | | Direct Query |
| #34 | LWS Optimize – All-in-One Speed Booster & Cache Tools | 27 | 35 | 534 | 10k+ | | | Non-prefixed global variable |
| #35 | WPBase Cache | 27 | 189 | 113 | 2k+ | | | Text Domain Mismatch |
| #36 | Redis Object Cache | 28 | 151 | 103 | 400k+ | | | Exception output is not escaped |
| #37 | WP YouTube Lyte | 28 | 205 | 178 | 20k+ | | | Non-prefixed global variable |
| #38 | DB Cache Reloaded Fix | 29 | 133 | 42 | 2k+ | | | Output is not escaped |
| #39 | Jetpack Boost – Website Speed, Performance and Critical CSS | 29 | 659 | 247 | 200k+ | | | Text Domain Mismatch |
| #40 | Offload Media – Cloud Storage | 29 | 126 | 80 | 1k+ | | | unlink unlink |
| #41 | SQLite Database Integration | 29 | 161 | 89 | 3k+ | | | Exception output is not escaped |
| #42 | Advanced Database Cleaner – Optimize & Clean Database to Speed Up Site Performance | 30 | 173 | 479 | 100k+ | | | Interpolated SQL is not prepared |
| #43 | Hosting Benchmark tool | 30 | 224 | 130 | 4k+ | | | rand rand |
| #44 | AEH Speed Optimization: Browser Cache, Optimized Minify, Lazy Loading & Image Optimization | 31 | 91 | 133 | 2k+ | | | Output is not escaped |
| #45 | Query Monitor | 31 | 44 | 273 | 200k+ | | | Non-prefixed class |
| #46 | Staatic – Static Site Generator for WordPress | 31 | 420 | 195 | 3k+ | | | SQL query is not prepared |
| #47 | Speed Kit | 32 | 296 | 73 | 2k+ | | | Output is not escaped |
| #48 | Freesoul Deactivate Plugins – Disable plugins on individual WordPress pages | 32 | 55 | 785 | 8k+ | | | Nonce verification recommended |
| #49 | Insights from Google PageSpeed | 32 | 414 | 475 | 10k+ | | | Text Domain Mismatch |
| #50 | Fastly | 33 | 221 | 66 | 1k+ | | | Text Domain Mismatch |