Supply Chain Issues
Issue Codes
3 normalized finding codes in this category.
Hidden files included
hidden_files
The plugin package contains hidden files or directories that usually should not ship in a WordPress.org release.
Compressed files included
compressed_files
The plugin package contains nested archives or compressed files.
Obfuscated code detected
obfuscated_code_detected
The plugin contains code that appears intentionally hard to read or review.
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #501 | Advanced Scrollbar – Custom Scrollbar Styling and Behavior | 35 | 2 | 0 | 700 | Hidden files included | ||
| #502 | Affiliate Link Marker | 35 | 31 | 4 | 400 | Text Domain Mismatch | ||
| #503 | AfterSalesPro Plugin | 35 | 24 | 111 | 400 | Nonce verification recommended | ||
| #504 | Air WP Sync – Airtable to WordPress | 35 | 37 | 45 | 1k+ | Non-prefixed hook name | ||
| #505 | AJAX Heartbeat Tool | 35 | 6 | 1 | 400 | Hidden files included | ||
| #506 | Akismet Anti-spam: Spam Protection | 35 | 33 | 99 | 5m+ | Non-prefixed global variable | ||
| #507 | AMIMOTO Plugin Dashboard | 35 | 82 | 82 | 900 | Non Singular String Literal Domain | ||
| #508 | Analytics Tracker | 35 | 4 | 5 | 1k+ | Hidden files included | ||
| #509 | Animate In View | 35 | 12 | 0 | 1k+ | Hidden files included | ||
| #510 | Antideo Email Validator | 35 | 38 | 98 | 800 | Missing nonce verification | ||
| #511 | AppMySite – WordPress & WooCommerce Mobile App Builder (No-Code Android & iOS App Maker) | 35 | 165 | 37 | 7k+ | Missing Arg Domain | ||
| #512 | Archive Content with Archived Post Status | 35 | 3 | 2 | 5k+ | Discouraged text-domain loading | ||
| #513 | Aurora Heatmap | 35 | 14 | 18 | 20k+ | Non-prefixed global variable | ||
| #514 | Auto Login for Sakura Rental Server | 35 | 3 | 3 | 10k+ | Hidden files included | ||
| #515 | Autocomplete For Relevanssi | 35 | 30 | 9 | 900 | Unsafe printing function | ||
| #516 | Avif Express | 35 | 26 | 167 | 400 | Input is not validated | ||
| #517 | Axeptio – Cookie Banner – GDPR Consent & Compliance with a friendly touch | 35 | 5 | 13 | 8k+ | Database parameter is not escaped | ||
| #518 | AXP Cyrillic to Latin | 35 | 21 | 3 | 1k+ | Output is not escaped | ||
| #519 | BabyLoveGrowth Integration | 35 | 2 | 10 | 1k+ | Direct Query | ||
| #520 | BackWPup – WordPress Backup & Restore Plugin | 35 | 11 | 779 | 500k+ | Non-prefixed global variable | ||
| #521 | BASE Item List | 35 | 4 | 13 | 800 | error log error log | ||
| #522 | bbPress Notify (No-Spam) | 35 | 62 | 66 | 2k+ | wp function not compatible with requires wp | ||
| #523 | Better Plugin Compatibility Control | 35 | 7 | 4 | 4k+ | trademarked term | ||
| #524 | Better Recent Comments | 35 | 127 | 29 | 2k+ | Text Domain Mismatch | ||
| #525 | Lord of the Files: Enhanced Upload Security | 35 | 62 | 42 | 1k+ | Non-prefixed global variable | ||
| #526 | Block Comment Spam Bots | 35 | 31 | 17 | 800 | Output is not escaped | ||
| #527 | CTC Masonry Gallery 🎨 | 35 | 6 | 3 | 1k+ | Hidden files included | ||
| #528 | Gutenberg Block for WooCommerce Product Table | 35 | 14 | 4 | 3k+ | Hidden files included | ||
| #529 | Block Manager | 35 | 33 | 26 | 4k+ | Text Domain Mismatch | ||
| #530 | Gutenberg Block Editor Toolkit – EditorsKit | 35 | 61 | 25 | 20k+ | Text Domain Mismatch | ||
| #531 | BlockArt Blocks – Gutenberg Blocks, Page Builder Blocks ,WordPress Block Plugin, Sections & Template Library | 35 | 56 | 16 | 10k+ | block api version too low | ||
| #532 | Blocks for Eventbrite | 35 | 3 | 4 | 1k+ | Hidden files included | ||
| #533 | Bluehost Site Migrator | 35 | 11 | 18 | 4k+ | Missing direct file access protection | ||
| #534 | bookingflow Smoobu for WP | 35 | 107 | 12 | 400 | Text Domain Mismatch | ||
| #535 | Bootstrap for Contact Form 7 | 35 | 35 | 73 | 10k+ | Nonce verification recommended | ||
| #536 | BuddyPress Activity Filter | 35 | 25 | 66 | 400 | Nonce verification recommended | ||
| #537 | Wbcom Designs – BuddyPress Activity Social Share | 35 | 293 | 27 | 400 | Text Domain Mismatch | ||
| #538 | Brozzme DB Prefix & Tools Addons | 35 | 24 | 42 | 10k+ | Request data is not unslashed | ||
| #539 | BSK Forms Blacklist | 35 | 831 | 550 | 1k+ | Output is not escaped | ||
| #540 | BugHerd | 35 | 8 | 2 | 3k+ | Output is not escaped | ||
| #541 | Bulk Download for Gravity Forms | 35 | 5 | 2 | 500 | Hidden files included | ||
| #542 | Bulk Page Stub Creator | 35 | 4 | 2 | 500 | Non-prefixed constant | ||
| #543 | C3 Cloudfront Cache Controller | 35 | 109 | 60 | 3k+ | Non Singular String Literal Domain | ||
| #544 | UseStrict's Calendly Embedder | 35 | 4 | 1 | 2k+ | Hidden files included | ||
| #545 | Divi Carousel Lite – Responsive Carousel & Slider Modules for Divi Builder | 35 | 381 | 7 | 6k+ | Text Domain Mismatch | ||
| #546 | CatFolders – WordPress Media Library Folders & Categories | 35 | 35 | 76 | 6k+ | Direct Query | ||
| #547 | Central Connect | 35 | 7 | 21 | 400 | Nonce verification recommended | ||
| #548 | CF7 Spreadsheets | 35 | 100 | 62 | 400 | Text Domain Mismatch | ||
| #549 | CF7 Submissions – Securely Store Contact Form 7 Data and Attachments, Reply to the Sender and more | 35 | 16 | 119 | 2k+ | Non-prefixed global variable | ||
| #550 | Popup for CF7 with Sweet Alert | 35 | 26 | 12 | 2k+ | Text Domain Mismatch |
