PluginScore

WordPress.DB.PreparedSQLPlaceholders.UnquotedComplexPlaceholder

Unquoted Complex Placeholder

A SQL query is built in a way that Plugin Check cannot verify as safely prepared.

critical weight

Why It Shows Up

The scan found missing, incorrect, quoted, unsupported, or mismatched SQL placeholders around `$wpdb->prepare()` usage.

Why It Matters

Broken preparation can leave dynamic SQL values unsafe or make queries behave differently than intended.

How to Fix

  • Keep placeholders in the SQL string and pass dynamic values as separate arguments.
  • Use the placeholder that matches the value type.
  • Do not quote placeholders manually, and use allowlists for identifiers or SQL fragments.

References

WordPress database access

Affected Plugins

RankPluginScoreErrorsWarningsInstallsUpdatedTop Issue
#1Razorpay for WooCommerce20974855100k+Non Prefixed Function Found
#2MotoPress Hotel Booking213,0611,03710k+Text Domain Mismatch
#3Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred211,4693,33310k+Non Prefixed Variable Found
#4Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent222255198k+error log error log
#5UserFeedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds22444243200k+Text Domain Mismatch
#6WooCommerce221,3556,1297m+Non Prefixed Variable Found
#7Easy Digital Downloads – eCommerce Payments and Subscriptions made easy233,72310,28340k+Non Prefixed Namespace Found
#8License Manager for WooCommerce231298196k+Missing Unslash
#9MotoPress Appointment Booking232,3628572k+Text Domain Mismatch
#10Pricing Table by Supsystic231,29944710k+Non Singular String Literal Domain
#11FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce231,1252,15320k+missing direct file access protection
#12WP Webhooks – Automate repetitive tasks by creating powerful automation workflows directly within WordPress234,37689020k+Output Not Escaped
#13Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress232,3171,7145k+Output Not Escaped
#14Awesome Support – WordPress HelpDesk & Support Plugin242251,2396k+Non Prefixed Variable Found
#15Product Feed Manager For WooCommerce – Sell on 200+ Online Marketplaces242,2483,33810k+slow db query meta key
#16Contact Form by Supsystic241,9136336k+Non Singular String Literal Domain
#17ELEX WooCommerce Request a Quote243982662k+Missing Unslash
#18Easy Google Maps241,76438920k+Non Singular String Literal Domain
#19Mang Board WP241,2494,7209k+Non Prefixed Variable Found
#20Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker244062,58140k+Non Prefixed Hookname Found
#21SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery248321,9014k+Non Prefixed Variable Found
#22Sugar Calendar – Events Calendar, Event Tickets, and Events Management Platform2442895610k+Output Not Escaped
#23Ultimate Maps by Supsystic241,03437410k+Non Singular String Literal Domain
#24UpdraftPlus: WP Backup & Migration Plugin242772993m+Non Prefixed Variable Found
#25Advanced Shipment Tracking for WooCommerce2465465160k+Missing Arg Domain
#26WP Recipe Maker2448192650k+Non Prefixed Variable Found
#27FunnelKit – Funnel Builder for WooCommerce Checkout253,2782,57430k+Text Domain Mismatch
#28Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails254,6751,4555k+Text Domain Mismatch
#29Media Cleaner: Clean your WordPress!2515139190k+Direct Query
#30NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar2525739740k+Non Prefixed Hookname Found
#31Post Snippets – Custom WordPress Code Snippets Customizer258081,64020k+Non Prefixed Variable Found
#32SEO Repair Kit – Meta Manager, Schema Manager, SEO Content Monitoring, GSC Integration, Keyword & Rank Tracking251969022k+Direct Query
#33ShopMagic – email automation2522814510k+Exception Not Escaped
#34TrackShip for WooCommerce254338806k+Non Prefixed Variable Found
#35TranslatePress – Translate Multilingual sites with AI Translation254521,541400k+Non Prefixed Hookname Found
#36WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards251,4311,27010k+Output Not Escaped
#37Speed Booster Pack ⚡ PageSpeed Optimization Suite271081879k+Missing Translators Comment
#38Zorem Local Pickup283754003k+Text Domain Mismatch
#39FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider297478600k+Missing Translators Comment
#40Form Vibes – Database Manager for Forms3117628410k+Text Domain Mismatch
#41MWB HubSpot for WooCommerce – CRM, Abandoned Cart, Email Marketing, Marketing Automation & Analytics33262797k+Non Prefixed Variable Found
#42CartBounty – Save and recover abandoned carts for WooCommerce3337039910k+Output Not Escaped
#43WP Mail Logging3476258300k+Recommended
#44Kirki – Freeform Page Builder, Website Builder & Customizer35775500k+Recommended
#45Sticky Chat Widget – Floating Chat Icons, Contact Form, Call, Click to Chat, Email & Message Buttons353329310k+Non Prefixed Variable Found
#46Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder36332110k+Recommended
#47Country State City Dropdown CF74035545k+Direct Query
#48Sendcloud Shipping4278565k+Output Not Escaped
#49ELEX WooCommerce Role Based Pricing442131962k+Non Prefixed Variable Found