PluginScore

WordPress.DB.PreparedSQLPlaceholders.QuotedSimplePlaceholder

Quoted Simple Placeholder

A SQL query is built in a way that Plugin Check cannot verify as safely prepared.

critical weight

Why It Shows Up

The scan found missing, incorrect, quoted, unsupported, or mismatched SQL placeholders around `$wpdb->prepare()` usage.

Why It Matters

Broken preparation can leave dynamic SQL values unsafe or make queries behave differently than intended.

How to Fix

  • Keep placeholders in the SQL string and pass dynamic values as separate arguments.
  • Use the placeholder that matches the value type.
  • Do not quote placeholders manually, and use allowlists for identifiers or SQL fragments.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsUpdatedTop Issue
#1Themify Builder95,1952,0965k+Text Domain Mismatch
#2Podlove Podcast Publisher182,3261,4293k+Output is not escaped
#3Download Monitor194251,36480k+Non-prefixed hook name
#4Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps)193,2753,22810k+Output is not escaped
#5Membership Plugin – Kadence Memberships195,0822,9829k+Text Domain Mismatch
#6SendPress Newsletters192,2931,4222k+Output is not escaped
#7BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot205081,40630k+Non-prefixed global variable
#8Brizy – Page Builder2058972070k+Output is not escaped
#9Filter Everything — WordPress & WooCommerce Filters2056873050k+Output is not escaped
#10GiveWP – Donation Plugin and Fundraising Platform203,4353,580100k+Output is not escaped
#11Link Library201,9411,39710k+Unsafe printing function
#12Robin Image Optimizer – Unlimited Image Optimization, WebP & AVIF20557541100k+Output is not escaped
#13EventPrime – Events Calendar, Bookings and Tickets218724,2977k+Non-prefixed global variable
#14MotoPress Hotel Booking213,0611,03710k+Text Domain Mismatch
#15User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor216961,48350k+Nonce verification recommended
#16PublishPress Planner – Editorial Calendar, Marketing Content, Kanban Board216038906k+Output is not escaped
#17WCFM – Frontend Manager for WooCommerce214,7215,06720k+Non-prefixed global variable
#18WP phpMyAdmin214,5286,43550k+Missing Arg Domain
#19Advanced Classifieds & Directory Pro221,2293,5112k+Non-prefixed global variable
#20All-in-One Video Gallery229112,89220k+Non-prefixed global variable
#21Knowledge Base documentation & wiki plugin – BasePress Docs226711,7672k+Non-prefixed global variable
#22Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer222,8581,27050k+Text Domain Mismatch
#23Directorist: AI-Powered Business Directory, Listings & Classified Ads224432,12920k+Non-prefixed global variable
#24Easy Social Feed – Social Photos Gallery and Post Feed for WordPress221,5671,27730k+Non-prefixed global variable
#25Estatik Real Estate Plugin223,04932510k+Text Domain Mismatch
#26Events Manager – Calendar, Bookings, Tickets, and more!224,7225,62170k+Output is not escaped
#27GeoDirectory – WP Business Directory Plugin and Classified Listings Directory224,4623,97210k+Output is not escaped
#28InfiniteWP Client222,2861,812200k+Exception output is not escaped
#29Import WP – Export and Import CSV and XML files to WordPress225803304k+Exception output is not escaped
#30LearnPress – WordPress LMS Plugin for Create and Sell Online Courses222,3613,38470k+Non-prefixed global variable
#31MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.222,6192,45310k+Output is not escaped
#32Modula Image Gallery – Photo Grid & Video Gallery22474436100k+Text Domain Mismatch
#33Product Catalog Feed by PixelYourSite225813578k+Output is not escaped
#34Restrict User Access – Ultimate Membership & Content Protection229771,84010k+Non-prefixed global variable
#35Seraphinite Accelerator2259425550k+Output is not escaped
#36URL Shortify – Simple and Easy URL Shortener221,5202,68910k+Non-prefixed global variable
#37WCFM Marketplace – Multivendor Marketplace for WooCommerce221,9371,96910k+Non-prefixed global variable
#38ManageWP Worker225075651m+Non-prefixed class
#39Asset CleanUp: Page Speed Booster222,0302,485100k+Non-prefixed global variable
#40WP Umbrella: Update Backup Restore & Monitoring2291590570k+Exception output is not escaped
#41WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell225,9962,7905k+Text Domain Mismatch
#42School Management System – WPSchoolPress223145,2201k+Non-prefixed global variable
#43BA Book Everything231,1841,08610k+Output is not escaped
#44Booking calendar, Appointment Booking System231,0791,1254k+Output is not escaped
#45WPBot – AI ChatBot for Live Support, Lead Generation, AI Services232641,0385k+Non-prefixed global variable
#46Content Aware Sidebars – Fastest Widget Area Plugin239931,73830k+Non-prefixed global variable
#47Content Egg – Affiliate Product Importer & Price Comparison231,2311,25710k+Non-prefixed global variable
#48Easy Digital Downloads – eCommerce Payments and Subscriptions made easy233,72310,28340k+Non-prefixed namespace
#49Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder234,7461,27930k+Non Singular String Literal Domain
#50FV Flowplayer Video Player231,3111,45420k+Output is not escaped