| #1 | Kadence Security – Password, Two Factor Authentication, and Brute Force Protection | 23 | 1,053 | 967 | 700k+ | | | Missing Translators Comment |
| #2 | All-In-One Security (AIOS) – Security and Firewall | 24 | 552 | 1,228 | 1m+ | | | Non-prefixed global variable |
| #3 | WP 2FA – Two-factor authentication for WordPress | 25 | 283 | 716 | 100k+ | | | Non-prefixed global variable |
| #4 | Wordfence Login Security | 25 | 248 | 418 | 60k+ | | | Output is not escaped |
| #5 | Rublon Multi-Factor Authentication (MFA) | 30 | 216 | 160 | 400 | | | Output is not escaped |
| #6 | Titan Anti-spam & Security – Brute Force Protection, 2FA & Spam Filter | 31 | 57 | 196 | 50k+ | | | Nonce verification recommended |
| #7 | Customize My Account for WooCommerce – Custom Tabs, Login, Registration, 2FA & Design | 38 | 78 | 172 | 800 | | | Non-prefixed global variable |
| #8 | WP 2-step verification | 32 | 154 | 65 | 1k+ | | | Output is not escaped |
| #9 | Per User Prompt for Google Authenticator | 43 | 8 | 52 | 400 | | | Nonce verification recommended |
| #10 | Two Factor (2FA) Authentication via Email | 61 | 12 | 27 | 9k+ | | | Request data is not unslashed |
| #11 | miniOrange 2FA – Two Factor Authentication for WordPress (OTP, SMS, Email, Google Authenticator) | 99 | | 6 | 10k+ | | | Non-prefixed constant |
