Supply Chain Issues
Issue Codes
3 normalized finding codes in this category.
Hidden files included
hidden_files
The plugin package contains hidden files or directories that usually should not ship in a WordPress.org release.
Compressed files included
compressed_files
The plugin package contains nested archives or compressed files.
Obfuscated code detected
obfuscated_code_detected
The plugin contains code that appears intentionally hard to read or review.
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #601 | DOOFINDER Search and Discovery for WP & WooCommerce | 35 | 151 | 120 | 2k+ | Text Domain Mismatch | ||
| #602 | Dropshipping XML for WooCommerce | 35 | 9 | 27 | 800 | Non-prefixed global variable | ||
| #603 | Duplica – Duplicate Posts, Pages, Custom Posts or Users | 35 | 14 | 31 | 2k+ | Non-prefixed global variable | ||
| #604 | DynamicTags | 35 | 116 | 16 | 2k+ | Text Domain Mismatch | ||
| #605 | Easy Image Gallery | 35 | 21 | 1 | 5k+ | wp function not compatible with requires wp | ||
| #606 | Easy Panorama | 35 | 120 | 10 | 500 | Non Singular String Literal Domain | ||
| #607 | Easy Post Types and Fields | 35 | 138 | 135 | 1k+ | Text Domain Mismatch | ||
| #608 | Easy SwipeBox | 35 | 157 | 10 | 2k+ | Non Singular String Literal Domain | ||
| #609 | Easy Tabs Block – Smart, Lightweight & Responsive Tabs for the Block Editor | 35 | 2 | 0 | 1k+ | Hidden files included | ||
| #610 | Easy Watermark | 35 | 82 | 53 | 30k+ | Non-prefixed global variable | ||
| #611 | Editorial Calendar | 35 | 127 | 160 | 20k+ | Output is not escaped | ||
| #612 | Gutenberg Blocks Library & Toolkit – Editor Plus | 35 | 27 | 11 | 6k+ | Text Domain Mismatch | ||
| #613 | Ele Conditions for Elementor | 35 | 2 | 7 | 4k+ | Request data is not unslashed | ||
| #614 | Elements Hive for Breakdance | 35 | 76 | 25 | 1k+ | Output is not escaped | ||
| #615 | Elfsight Blocks for Elementor — 80+ Widgets | 35 | 444 | 3 | 2k+ | Text Domain Mismatch | ||
| #616 | Gallery for Google Photos – Import and Display Photo Albums | 35 | 1 | 4 | 1k+ | Nonce verification recommended | ||
| #617 | Embed PDF Viewer | 35 | 1 | 2 | 20k+ | Hidden files included | ||
| #618 | Embed Privacy | 35 | 10 | 41 | 10k+ | slow db query meta key | ||
| #619 | Enable Responsive Image | 35 | 1 | 1 | 1k+ | Hidden files included | ||
| #620 | WP Rocket | Simple LoadCSS Preloader | 35 | 7 | 16 | 4k+ | Non-prefixed global variable | ||
| #621 | Enhanced Recent Posts | 35 | 78 | 24 | 400 | Output is not escaped | ||
| #622 | Enlighter – Customizable Syntax Highlighter | 35 | 50 | 10 | 10k+ | Output is not escaped | ||
| #623 | Equivalent Mobile Redirect | 35 | 29 | 17 | 2k+ | Text Domain Mismatch | ||
| #624 | EU/UK VAT Validation Manager for WooCommerce | 35 | 1 | 0 | 6k+ | Hidden files included | ||
| #625 | Ever Compare – Products Compare Plugin for WooCommerce | 35 | 2 | 23 | 600 | Non-prefixed global variable | ||
| #626 | EWWW Image Optimizer | 35 | 225 | 731 | 1m+ | Direct Query | ||
| #627 | Expire User Passwords | 35 | 3 | 15 | 3k+ | Nonce verification recommended | ||
| #628 | Extendify | 35 | 80 | 64 | 500k+ | Text Domain Mismatch | ||
| #629 | Extra Shortcodes | 35 | 35 | 3 | 1k+ | date date | ||
| #630 | F4 Shipping Phone and E-Mail for WooCommerce | 35 | 21 | 30 | 800 | Non-prefixed hook name | ||
| #631 | Pixel Cat – Conversion Pixel Manager | 35 | 253 | 215 | 40k+ | Output is not escaped | ||
| #632 | Fancy Elements for Avada | 35 | 371 | 10 | 400 | Text Domain Mismatch | ||
| #633 | Instant Indexing for Google | 35 | 13 | 62 | 200k+ | Non-prefixed global variable | ||
| #634 | Windows Compatibility Fix | 35 | 13 | 6 | 1k+ | Plugin Directory Write | ||
| #635 | Flat Preloader | 35 | 40 | 15 | 3k+ | Output is not escaped | ||
| #636 | Flexible PDF Coupons – Gift Cards & Vouchers for WooCommerce | 35 | 8 | 20 | 2k+ | Non-prefixed global variable | ||
| #637 | Flexible PDF Invoices for WooCommerce & WordPress | 35 | 15 | 55 | 6k+ | Non-prefixed global variable | ||
| #638 | Flexible Refund for WooCommerce – EU One Click Return | 35 | 5 | 8 | 2k+ | Non-prefixed global variable | ||
| #639 | Flying Analytics: Self-Host Google Analytics v4 with Speed Optimization | 35 | 17 | 13 | 4k+ | Missing direct file access protection | ||
| #640 | Flying Fonts: Remove Google Fonts & Use System Fonts for Faster Performance | 35 | 3 | 1 | 700 | Hidden files included | ||
| #641 | Events Calendar by FooEvents | 35 | 57 | 59 | 4k+ | Non-prefixed global variable | ||
| #642 | Force Email Login | 35 | 5 | 0 | 800 | Hidden files included | ||
| #643 | Force Regenerate Thumbnails | 35 | 12 | 17 | 200k+ | unlink unlink | ||
| #644 | Force Reinstall | 35 | 118 | 34 | 2k+ | Output is not escaped | ||
| #645 | Form Input Masks For Elementor Forms | 35 | 3 | 1 | 10k+ | Hidden files included | ||
| #646 | FrontBlocks for Gutenberg/GeneratePress | 35 | 10 | 7 | 500 | Offloaded Content | ||
| #647 | GD bbPress Attachments | 35 | 2 | 10 | 6k+ | wp redirect wp redirect | ||
| #648 | Genesis Simple Sidebars | 35 | 9 | 51 | 10k+ | Nonce verification recommended | ||
| #649 | GeoTargeting Lite – WordPress Geolocation | 35 | 66 | 79 | 1k+ | Output is not escaped | ||
| #650 | Get a Newsletter | 35 | 138 | 144 | 400 | Output is not escaped |
