Security Issues
Issue Codes
40 normalized finding codes in this category.
Output is not escaped
WordPress.Security.EscapeOutput.OutputNotEscaped
Dynamic data is printed to the page without an escaping function for the output context.
Request data is not unslashed
WordPress.Security.ValidatedSanitizedInput.MissingUnslash
Input from a WordPress request superglobal is used before removing WordPress-added slashes.
Input is not sanitized
WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
Request data is used without being cleaned for the expected type or format.
Nonce verification recommended
WordPress.Security.NonceVerification.Recommended
The code reads request data in a place where Plugin Check recommends a nonce check.
Input is not validated
WordPress.Security.ValidatedSanitizedInput.InputNotValidated
Request data is used without checking that it is allowed for the operation.
Missing nonce verification
WordPress.Security.NonceVerification.Missing
A request handler uses request data without verifying that the request was intentionally created by WordPress.
Unsafe printing function
WordPress.Security.EscapeOutput.UnsafePrintingFunction
A printing function is outputting dynamic content without proving that the content is escaped.
Database parameter is not escaped
PluginCheck.Security.DirectDB.UnescapedDBParameter
A value is passed into database-related code without escaping, preparation, or strict allowlisting.
wp redirect wp redirect
WordPress.Security.SafeRedirect.wp_redirect_wp_redirect
Plugin Check reported a security-sensitive coding pattern that needs review.
SQL query is not prepared
WordPress.DB.PreparedSQL.NotPrepared
A database query includes dynamic data without using `$wpdb->prepare()` or an equivalent safe pattern.
Interpolated SQL is not prepared
WordPress.DB.PreparedSQL.InterpolatedNotPrepared
Variables are interpolated into a SQL string before the query is prepared.
Exception output is not escaped
WordPress.Security.EscapeOutput.ExceptionNotEscaped
An exception message or related exception value is printed without escaping.
Setting is missing a sanitization callback
PluginCheck.CodeAnalysis.SettingSanitization.register_settingMissing
A registered setting does not define a sanitization callback.
Unfinished Prepare
WordPress.DB.PreparedSQLPlaceholders.UnfinishedPrepare
A SQL query is built in a way that Plugin Check cannot verify as safely prepared.
Quoted Simple Placeholder
WordPress.DB.PreparedSQLPlaceholders.QuotedSimplePlaceholder
A SQL query is built in a way that Plugin Check cannot verify as safely prepared.
Replacements Wrong Number
WordPress.DB.PreparedSQLPlaceholders.ReplacementsWrongNumber
A SQL query is built in a way that Plugin Check cannot verify as safely prepared.
Plugin menu slug uses __FILE__
WordPress.Security.PluginMenuSlug.Using__FILE__
Plugin Check reported a security-sensitive coding pattern that needs review.
Input is not validated or sanitized
WordPress.Security.ValidatedSanitizedInput.InputNotValidatedNotSanitized
Request data is used without both cleanup and an allowability check.
Like Wildcards In Query
WordPress.DB.PreparedSQLPlaceholders.LikeWildcardsInQuery
A SQL query is built in a way that Plugin Check cannot verify as safely prepared.
Heredoc Output Not Escaped
WordPress.Security.EscapeOutput.HeredocOutputNotEscaped
A value reaches browser output without clear escaping for the final HTML context.
Unnecessary Prepare
WordPress.DB.PreparedSQLPlaceholders.UnnecessaryPrepare
A SQL query is built in a way that Plugin Check cannot verify as safely prepared.
Unsupported Identifier Placeholder
WordPress.DB.PreparedSQLPlaceholders.UnsupportedIdentifierPlaceholder
A SQL query is built in a way that Plugin Check cannot verify as safely prepared.
Unquoted Complex Placeholder
WordPress.DB.PreparedSQLPlaceholders.UnquotedComplexPlaceholder
A SQL query is built in a way that Plugin Check cannot verify as safely prepared.
Like Wildcards In Query With Placeholder
WordPress.DB.PreparedSQLPlaceholders.LikeWildcardsInQueryWithPlaceholder
A SQL query is built in a way that Plugin Check cannot verify as safely prepared.
Deprecated function: attribute_escape
WordPress.WP.DeprecatedFunctions.attribute_escapeFound
The plugin uses a WordPress API, parameter, class, or value that has been deprecated.
Unsupported Placeholder
WordPress.DB.PreparedSQLPlaceholders.UnsupportedPlaceholder
A SQL query is built in a way that Plugin Check cannot verify as safely prepared.
Quoted Dynamic Placeholder Generation
WordPress.DB.PreparedSQLPlaceholders.QuotedDynamicPlaceholderGeneration
A SQL query is built in a way that Plugin Check cannot verify as safely prepared.
mysql mysqli real escape string
WordPress.DB.RestrictedFunctions.mysql_mysqli_real_escape_string
The plugin uses a raw MySQL extension or class instead of WordPress database APIs.
Deprecated function: like_escape
WordPress.WP.DeprecatedFunctions.like_escapeFound
The plugin uses a WordPress API, parameter, class, or value that has been deprecated.
Like Without Wildcards
WordPress.DB.PreparedSQLPlaceholders.LikeWithoutWildcards
A SQL query is built in a way that Plugin Check cannot verify as safely prepared.
mysql mysql real escape string
WordPress.DB.RestrictedFunctions.mysql_mysql_real_escape_string
The plugin uses a raw MySQL extension or class instead of WordPress database APIs.
Unescaped Literal
WordPress.DB.PreparedSQLPlaceholders.UnescapedLiteral
A SQL query is built in a way that Plugin Check cannot verify as safely prepared.
Deprecated function: js_escape
WordPress.WP.DeprecatedFunctions.js_escapeFound
The plugin uses a WordPress API, parameter, class, or value that has been deprecated.
Missing Replacements
WordPress.DB.PreparedSQLPlaceholders.MissingReplacements
A SQL query is built in a way that Plugin Check cannot verify as safely prepared.
curl curl escape
WordPress.WP.AlternativeFunctions.curl_curl_escape
The plugin uses raw cURL functions instead of the WordPress HTTP API.
curl curl unescape
WordPress.WP.AlternativeFunctions.curl_curl_unescape
The plugin uses raw cURL functions instead of the WordPress HTTP API.
register setting Invalid
PluginCheck.CodeAnalysis.SettingSanitization.register_settingInvalid
Plugin Check reported a security-sensitive coding pattern that needs review.
Deprecated function: sanitize_user_object
WordPress.WP.DeprecatedFunctions.sanitize_user_objectFound
The plugin uses a WordPress API, parameter, class, or value that has been deprecated.
Deprecated function: wp_sanitize_script_attributes
WordPress.WP.DeprecatedFunctions.wp_sanitize_script_attributesFound
The plugin uses a WordPress API, parameter, class, or value that has been deprecated.
Quoted Identifier Placeholder
WordPress.DB.PreparedSQLPlaceholders.QuotedIdentifierPlaceholder
A SQL query is built in a way that Plugin Check cannot verify as safely prepared.
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #1 | BulletProof Security | 0 | 5,048 | 4,949 | 20k+ | Output is not escaped | ||
| #2 | Intercom | 0 | 60 | 71 | 6k+ | Non-prefixed function | ||
| #3 | Live Shopping & Shoppable Videos For WooCommerce | 0 | 79 | 174 | 400 | Non-prefixed global variable | ||
| #4 | Plugin Check (PCP) | 0 | 128 | 140 | 10k+ | Non-prefixed global variable | ||
| #5 | Themify Builder | 9 | 5,334 | 2,171 | 5k+ | Text Domain Mismatch | ||
| #6 | JetBackup – Backup, Restore & Migrate | 10 | 1,567 | 156 | 200k+ | Exception output is not escaped | ||
| #7 | 404 Solution | 15 | 582 | 1,532 | 10k+ | Non-prefixed class | ||
| #8 | Easy WP SMTP – WordPress SMTP and Email Logs: Gmail SMTP, Office 365, Outlook, Custom SMTP, and more | 15 | 45 | 166 | 500k+ | Database parameter is not escaped | ||
| #9 | MDTF – Meta Data and Taxonomies Filter | 16 | 1,550 | 1,956 | 1k+ | Non-prefixed global variable | ||
| #10 | AnyComment | 17 | 445 | 449 | 5k+ | Output is not escaped | ||
| #11 | RestroPress – Online Food Ordering System | 17 | 535 | 3,234 | 1k+ | Non-prefixed global variable | ||
| #12 | Efí Bank | 17 | 886 | 553 | 300 | Exception output is not escaped | ||
| #13 | Shopping Cart & eCommerce Store | 17 | 7,492 | 17,554 | 3k+ | Non-prefixed global variable | ||
| #14 | wpForo Forum | 17 | 4,293 | 3,026 | 20k+ | Unsafe printing function | ||
| #15 | WPtouch – Make your WordPress Website Mobile-Friendly | 17 | 1,466 | 325 | 50k+ | Text Domain Mismatch | ||
| #16 | Administrator Z | 18 | 2,061 | 799 | 400 | Output is not escaped | ||
| #17 | Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution | 18 | 1,229 | 923 | 100k+ | Exception output is not escaped | ||
| #18 | JetFormBuilder — Dynamic Blocks Form Builder | 18 | 2,131 | 1,623 | 80k+ | Text Domain Mismatch | ||
| #19 | Pagopar – WooCommerce Gateway | 18 | 530 | 1,215 | 400 | Non-prefixed global variable | ||
| #20 | WPPizza – A Restaurant Plugin | 18 | 4,689 | 2,703 | 1k+ | Text Domain Mismatch | ||
| #21 | Block Slider – Responsive Image Slider, Video Slider & Post Slider | 19 | 555 | 1,291 | 3k+ | Non-prefixed global variable | ||
| #22 | GiveWP – Donation Plugin and Fundraising Platform | 19 | 3,402 | 3,555 | 100k+ | Output is not escaped | ||
| #23 | Go Fetch Jobs (for WP Job Manager) | 19 | 1,410 | 1,741 | 600 | Non-prefixed global variable | ||
| #24 | Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps) | 19 | 3,275 | 3,228 | 9k+ | Output is not escaped | ||
| #25 | Matomo Analytics – Powerful, Privacy-First Insights for WordPress | 19 | 1,993 | 892 | 100k+ | Exception output is not escaped | ||
| #26 | Netgsm | 19 | 352 | 348 | 1k+ | Non-prefixed global variable | ||
| #27 | Verified Reviews (Avis Vérifiés) | 19 | 671 | 1,136 | 700 | Non-prefixed global variable | ||
| #28 | Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) | 19 | 530 | 375 | 3m+ | Missing Translators Comment | ||
| #29 | Scrollsequence – Cinematic Scroll Image Animation Plugin | 19 | 878 | 1,528 | 3k+ | Non-prefixed global variable | ||
| #30 | SendPress Newsletters | 19 | 2,293 | 1,422 | 1k+ | Output is not escaped | ||
| #31 | SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments | 19 | 541 | 1,146 | 80k+ | Non-prefixed global variable | ||
| #32 | WP Email Template | 19 | 344 | 345 | 2k+ | Exception output is not escaped | ||
| #33 | WPOSS阿里云对象存储 | 19 | 269 | 315 | 900 | Non-prefixed namespace | ||
| #34 | WPQiNiu七牛云对象存储 | 19 | 138 | 612 | 400 | Non-prefixed global variable | ||
| #35 | AweBooking – Hotel Booking System | 20 | 309 | 514 | 1k+ | Non-prefixed global variable | ||
| #36 | Brizy – Page Builder | 20 | 585 | 726 | 60k+ | Output is not escaped | ||
| #37 | Broadstreet | 20 | 434 | 273 | 800 | Output is not escaped | ||
| #38 | Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) | 20 | 736 | 2,112 | 900 | Non-prefixed global variable | ||
| #39 | Cost Calculator Builder | 20 | 323 | 766 | 20k+ | Non-prefixed global variable | ||
| #40 | SysBasics Customize My Account for WooCommerce – Live My Account Customizer | 20 | 743 | 911 | 7k+ | Non-prefixed global variable | ||
| #41 | Download Monitor | 20 | 423 | 1,367 | 80k+ | Non-prefixed hook name | ||
| #42 | Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More | 20 | 2,878 | 1,988 | 1m+ | Non-prefixed global variable | ||
| #43 | Event Organiser | 20 | 1,104 | 544 | 20k+ | Text Domain Mismatch | ||
| #44 | EventPrime – Events Calendar, Bookings, Tickets & AI | 20 | 846 | 4,224 | 7k+ | Non-prefixed global variable | ||
| #45 | GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership | 20 | 1,832 | 720 | 700 | Non Singular String Literal Domain | ||
| #46 | MBE eShip | 20 | 527 | 740 | 1k+ | Non-prefixed global variable | ||
| #47 | Brevo – Email, SMS, Web Push, Chat, and more. | 20 | 460 | 646 | 100k+ | Request data is not unslashed | ||
| #48 | MAS Videos | 20 | 519 | 1,693 | 1k+ | Non-prefixed global variable | ||
| #49 | Microthemer Lite – Visual Editor to Customize CSS | 20 | 1,004 | 1,699 | 10k+ | Non-prefixed global variable | ||
| #50 | Nimble Page Builder | 20 | 1,591 | 1,684 | 30k+ | Missing Arg Domain |
