WordPress.DB.PreparedSQL.InterpolatedNotPrepared

Interpolated SQL is not prepared

Variables are interpolated into a SQL string before the query is prepared.

critical weight

Why It Shows Up

The scan found dynamic values placed directly inside SQL, often through string interpolation, before `$wpdb->prepare()` can safely bind them.

Why It Matters

Preparing a query after unsafe interpolation does not reliably protect the dynamic value.

How to Fix

  • Replace interpolated variables with placeholders.
  • Pass each dynamic value as a separate `$wpdb->prepare()` argument.
  • Use allowlists for SQL identifiers and directions that cannot be represented as normal values.

Affected Plugins

RankPluginScoreErrorsWarningsInstallsUpdatedTop Issue
#1BulletProof Security05,0484,94920k+Output Not Escaped
#2Themify Builder95,1952,0965k+Text Domain Mismatch
#3AnyComment174454495k+Output Not Escaped
#4JetFormBuilder — Dynamic Blocks Form Builder172,0941,58890k+Text Domain Mismatch
#5wpForo Forum174,0332,92220k+Unsafe Printing Function
#6WPtouch – Make your WordPress Website Mobile-Friendly171,46632550k+Text Domain Mismatch
#7Prime Slider Addons for Elementor183,500230100k+Text Domain Mismatch
#8WP Import Export Lite1873897940k+Non Prefixed Variable Found
#9Element Pack – Widgets, Templates & Addons for Elementor199,448517100k+Text Domain Mismatch
#10Download Monitor194251,36480k+Non Prefixed Hookname Found
#11Event Organiser191,10654420k+Text Domain Mismatch
#12Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution191,218901100k+Exception Not Escaped
#13Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps)193,2753,22810k+Output Not Escaped
#14Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization191,2952,6799k+Output Not Escaped
#15Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)195413853m+Missing Translators Comment
#16Membership Plugin – Kadence Memberships195,0822,9829k+Text Domain Mismatch
#17SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments195261,11990k+Non Prefixed Variable Found
#18BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot205081,40630k+Non Prefixed Variable Found
#19Brizy – Page Builder2058972070k+Output Not Escaped
#20Filter Everything — WordPress & WooCommerce Filters2056873050k+Output Not Escaped
#21GiveWP – Donation Plugin and Fundraising Platform203,4353,580100k+Output Not Escaped
#22Link Library201,9411,39710k+Unsafe Printing Function
#23Brevo – Email, SMS, Web Push, Chat, and more.20460646100k+Missing Unslash
#24Microthemer Lite – Visual Editor to Customize CSS201,0041,69910k+Non Prefixed Variable Found
#25Pix por Piggly (para Woocommerce)205471954k+Exception Not Escaped
#26Robin Image Optimizer – Unlimited Image Optimization, WebP & AVIF20557541100k+Output Not Escaped
#27Razorpay for WooCommerce20974855100k+Non Prefixed Function Found
#28WPJAM Basic203283564k+Output Not Escaped
#29Store Locator WordPress212,3721,57210k+Text Domain Mismatch
#30Backup Migration219811,09380k+Non Prefixed Variable Found
#31bbPress219293,672100k+Non Prefixed Function Found
#32Captcha Them All213003236k+Output Not Escaped
#33CartFlows – Funnel Builder & Checkout Plugin for WooCommerce21461614200k+Text Domain Mismatch
#34Smart Grid-Layout Design for Contact Form 7211,12673410k+Output Not Escaped
#35Free Downloads WooCommerce214303594k+Output Not Escaped
#36Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More212,5721,2771m+Output Not Escaped
#37eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams211864379k+Non Prefixed Variable Found
#38ERP: Complete HR, Accounting & CRM Suite with Recruitment and WooCommerce CRM Support218295,9665k+Direct Query
#39EventPrime – Events Calendar, Bookings and Tickets218724,2977k+Non Prefixed Variable Found
#40Feeds for YouTube (YouTube video, channel, and gallery plugin)21558978100k+Output Not Escaped
#41If-So Dynamic Content – Elementor & All Page Builders Personalization218897257k+Unsafe Printing Function
#42Imagify: Optimize Images for Top Speed (Compress & Convert to WebP/AVIF)214188511m+Non Prefixed Variable Found
#43MotoPress Hotel Booking213,0611,03710k+Text Domain Mismatch
#44Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred211,4693,33310k+Non Prefixed Variable Found
#45Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages211,1732,9839k+Non Prefixed Variable Found
#46Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction211,9185,06510k+Non Prefixed Hookname Found
#47User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor216961,48350k+Recommended
#48PublishPress Planner – Editorial Calendar, Marketing Content, Kanban Board216038906k+Output Not Escaped
#49Five Star Restaurant Reservations – WordPress Booking Plugin211,0991,14710k+Output Not Escaped
#50Royal Addons for Elementor – Addons and Templates Kit for Elementor2113,0112,530600k+Text Domain Mismatch