Supply Chain Issues
Issue Codes
3 normalized finding codes in this category.
Hidden files included
hidden_files
The plugin package contains hidden files or directories that usually should not ship in a WordPress.org release.
Compressed files included
compressed_files
The plugin package contains nested archives or compressed files.
Obfuscated code detected
obfuscated_code_detected
The plugin contains code that appears intentionally hard to read or review.
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #851 | SumUp Payment Gateway For WooCommerce | 35 | 29 | 62 | 10k+ | Nonce verification recommended | ||
| #852 | Super Cool Ad Inserter Plugin | 35 | 22 | 5 | 600 | Text Domain Mismatch | ||
| #853 | Svea Checkout for WooCommerce | 35 | 18 | 72 | 800 | Request data is not unslashed | ||
| #854 | Table for Divi | 35 | 5 | 2 | 2k+ | Hidden files included | ||
| #855 | Table Of Content Block – Auto-Generate Clickable Table of Contents | 35 | 2 | 1 | 3k+ | Hidden files included | ||
| #856 | TailPress – Tailwind for WordPress | 35 | 23 | 22 | 500 | Output is not escaped | ||
| #857 | Tapfiliate | 35 | 35 | 49 | 400 | Nonce verification recommended | ||
| #858 | Taxonomy Checklist Tree | 35 | 3 | 1 | 400 | Hidden files included | ||
| #859 | Taxonomy CSV Import Export | 35 | 5 | 30 | 700 | Missing nonce verification | ||
| #860 | TBThemes Theme Import | 35 | 84 | 48 | 400 | Text Domain Mismatch | ||
| #861 | TC Custom JavaScript | 35 | 19 | 26 | 10k+ | Missing Version | ||
| #862 | Teamleader CRM Forms | 35 | 150 | 30 | 500 | Non Singular String Literal Domain | ||
| #863 | Starter Sites & Templates by Neve | 35 | 28 | 88 | 100k+ | Non-prefixed hook name | ||
| #864 | Termageddon: Cookie Consent & Privacy Compliance | 35 | 27 | 13 | 7k+ | Exception output is not escaped | ||
| #865 | The Courier Guy Shipping for WooCommerce | 35 | 57 | 107 | 3k+ | Missing nonce verification | ||
| #866 | The Social Links | 35 | 16 | 29 | 2k+ | Non-prefixed global variable | ||
| #867 | theMarketer – Email marketing, Newsletters, Automation & Loyalty for Woocommerce | 35 | 4 | 47 | 700 | Nonce verification recommended | ||
| #868 | ThemeRain Core | 35 | 69 | 61 | 1k+ | Text Domain Mismatch | ||
| #869 | Themify Audio Dock | 35 | 22 | 9 | 900 | Non-prefixed global variable | ||
| #870 | Themify Icons | 35 | 33 | 12 | 3k+ | Output is not escaped | ||
| #871 | Themify Shortcodes | 35 | 36 | 16 | 7k+ | Output is not escaped | ||
| #872 | TikTok | 35 | 31 | 22 | 200k+ | Missing Arg Domain | ||
| #873 | TinyMCE Templates | 35 | 41 | 27 | 20k+ | Text Domain Mismatch | ||
| #874 | Tockify Events Calendar | 35 | 35 | 12 | 2k+ | Output is not escaped | ||
| #875 | Transcoder | 35 | 42 | 111 | 400 | Non-prefixed function | ||
| #876 | uCalc | 35 | 78 | 8 | 600 | Text Domain Mismatch | ||
| #877 | Unagi | 35 | 9 | 2 | 900 | Missing direct file access protection | ||
| #878 | Under Construction | 35 | 3 | 0 | 600k+ | Hidden files included | ||
| #879 | Use Google Libraries | 35 | 13 | 5 | 10k+ | Hidden files included | ||
| #880 | UTM for Woocommerce | 35 | 14 | 4 | 800 | Output is not escaped | ||
| #881 | Vendi Abandoned Plugin Check | 35 | 13 | 3 | 1k+ | trademarked term | ||
| #882 | Embed videos and respect privacy | 35 | 6 | 11 | 2k+ | Non-prefixed global variable | ||
| #883 | Walls.io: Social Media Feed | 35 | 10 | 7 | 1k+ | Hidden files included | ||
| #884 | WATI Chat and Notification | 35 | 9 | 0 | 600 | Missing direct file access protection | ||
| #885 | Wavy Divider | 35 | 10 | 1 | 700 | Hidden files included | ||
| #886 | WC Cancel Order | 35 | 52 | 122 | 5k+ | Non-prefixed hook name | ||
| #887 | Payphone – Payment Gateway Button | 35 | 3 | 2 | 2k+ | Hidden files included | ||
| #888 | Deliver via Shipos for WooCommerce | 35 | 11 | 78 | 600 | Nonce verification recommended | ||
| #889 | Product Attributes Shortcode | 35 | 3 | 4 | 700 | Nonce verification recommended | ||
| #890 | Webflow Pages | 35 | 36 | 63 | 2k+ | Non Singular String Literal Domain | ||
| #891 | Converter for Media – Optimize images | Convert WebP & AVIF | 35 | 131 | 53 | 500k+ | curl curl setopt | ||
| #892 | WEDOS OnLine monitoring | 35 | 36 | 15 | 700 | Output is not escaped | ||
| #893 | wePOS – Point Of Sale (POS) for WooCommerce & Dokan | 35 | 47 | 66 | 2k+ | Output is not escaped | ||
| #894 | What The File | 35 | 9 | 12 | 40k+ | Input is not sanitized | ||
| #895 | Which Elementor Addon | 35 | 26 | 3 | 500 | Text Domain Mismatch | ||
| #896 | All-in-One Addons for Elementor – WidgetKit | 35 | 60 | 311 | 8k+ | Non-prefixed global variable | ||
| #897 | Wild Apricot Login | 35 | 88 | 30 | 800 | Non Singular String Literal Domain | ||
| #898 | Social Preview and Open Graph Tags | 35 | 2 | 5 | 50k+ | Hidden files included | ||
| #899 | Asaas Gateway for WooCommerce | 35 | 12 | 109 | 8k+ | Non-prefixed global variable | ||
| #900 | Sola Payment Gateway for WooCommerce | 35 | 107 | 116 | 700 | Missing Translators Comment |
