Supply Chain Issues
Issue Codes
3 normalized finding codes in this category.
Hidden files included
hidden_files
The plugin package contains hidden files or directories that usually should not ship in a WordPress.org release.
Compressed files included
compressed_files
The plugin package contains nested archives or compressed files.
Obfuscated code detected
obfuscated_code_detected
The plugin contains code that appears intentionally hard to read or review.
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #351 | AJAX Login and Registration modal popup + inline form | 28 | 157 | 261 | 3k+ | Output is not escaped | ||
| #352 | Darklup – Enhanced WordPress Dark Mode, Dark Theme, Night Mode & Accessibility Plugin | 28 | 639 | 85 | 1k+ | Text Domain Mismatch | ||
| #353 | Expand Divi | 28 | 91 | 100 | 1k+ | Non-prefixed global variable | ||
| #354 | Kadence Starter Templates — Predesigned Website Templates | 28 | 312 | 215 | 200k+ | Missing Arg Domain | ||
| #355 | Laposta Signup Basic | 28 | 276 | 67 | 2k+ | Output is not escaped | ||
| #356 | Loginfy – Custom Login Page Customizer | 28 | 338 | 398 | 2k+ | Output is not escaped | ||
| #357 | PHP Browser Detection | 28 | 68 | 49 | 600 | Non-prefixed function | ||
| #358 | Pixel Gallery Addons for Elementor – Easy Grid, Creative Gallery, Drag and Drop Grid, Custom Grid Layout, Portfolio Gallery | 28 | 146 | 259 | 5k+ | Post Not In exclude | ||
| #359 | Pixelonetry Companion | 28 | 427 | 147 | 600 | Text Domain Mismatch | ||
| #360 | Podcast Importer SecondLine | 28 | 356 | 169 | 4k+ | Text Domain Mismatch | ||
| #361 | Query Wrangler | 28 | 628 | 229 | 700 | Output is not escaped | ||
| #362 | Redis Object Cache | 28 | 151 | 103 | 400k+ | Exception output is not escaped | ||
| #363 | Brilliant Web-to-Lead for Salesforce | 28 | 247 | 244 | 2k+ | Text Domain Mismatch | ||
| #364 | Praison AI SEO | 28 | 649 | 306 | 1k+ | Text Domain Mismatch | ||
| #365 | Transliterator – Multilingual and Multi-script Text Conversion | 28 | 305 | 322 | 3k+ | Output is not escaped | ||
| #366 | Terms descriptions | 28 | 222 | 423 | 1k+ | Non-prefixed function | ||
| #367 | WeeConnectPay – Clover Payment Gateway for WooCommerce | 28 | 179 | 171 | 500 | Exception output is not escaped | ||
| #368 | WP Booking System – Booking Calendar | 28 | 502 | 549 | 20k+ | Output is not escaped | ||
| #369 | Connect Matomo – Analytics Dashboard for WordPress | 28 | 100 | 102 | 60k+ | Missing Translators Comment | ||
| #370 | aThemes Starter Sites | 29 | 268 | 214 | 40k+ | Text Domain Mismatch | ||
| #371 | Plugin BlueX for WooCommerce | 29 | 431 | 216 | 2k+ | Text Domain Mismatch | ||
| #372 | Branded Social Images – Open Graph Images with logo and extra text layer | 29 | 254 | 91 | 900 | Non Singular String Literal Domain | ||
| #373 | CloudSecure WP Security | 29 | 74 | 350 | 100k+ | Request data is not unslashed | ||
| #374 | Display Tweets | 29 | 135 | 135 | 900 | Non-prefixed global variable | ||
| #375 | Document Gallery | 29 | 183 | 98 | 8k+ | Output is not escaped | ||
| #376 | Gianism | 29 | 391 | 154 | 700 | Text Domain Mismatch | ||
| #377 | Kits, Templates and Patterns | 29 | 380 | 91 | 5k+ | Text Domain Mismatch | ||
| #378 | Laposta WooCommerce | 29 | 96 | 115 | 500 | Non-prefixed global variable | ||
| #379 | PhastPress | 29 | 95 | 52 | 10k+ | Exception output is not escaped | ||
| #380 | PlatiOnline Payments | 29 | 304 | 110 | 700 | Output is not escaped | ||
| #381 | Post Timeline | 29 | 91 | 200 | 800 | Missing nonce verification | ||
| #382 | Recipe Card Blocks Lite | 29 | 151 | 408 | 10k+ | Non-prefixed global variable | ||
| #383 | Security Ninja – WordPress Security & Firewall | 29 | 149 | 347 | 7k+ | Direct Query | ||
| #384 | Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce | 29 | 148 | 245 | 5k+ | Unsafe printing function | ||
| #385 | Themify Popup | 29 | 232 | 108 | 8k+ | Text Domain Mismatch | ||
| #386 | Themify – WooCommerce Product Filter | 29 | 643 | 145 | 20k+ | Output is not escaped | ||
| #387 | Product Carousel Slider & Grid Ultimate for WooCommerce | 29 | 719 | 122 | 6k+ | Text Domain Mismatch | ||
| #388 | Woostify Sites Library | 29 | 229 | 198 | 20k+ | Text Domain Mismatch | ||
| #389 | WP Subscribe | 29 | 79 | 79 | 7k+ | Non-prefixed class | ||
| #390 | ApplyOnline – Application Form Builder and Manager | 30 | 345 | 244 | 2k+ | Output is not escaped | ||
| #391 | Kargo Takip, Kargo SMS, İlçe Mahalle Sözleşme by Hezarfen | 30 | 70 | 297 | 2k+ | Non-prefixed global variable | ||
| #392 | Laposta Signup Embed | 30 | 88 | 19 | 1k+ | Exception output is not escaped | ||
| #393 | Mailrelay | 30 | 318 | 170 | 1k+ | Text Domain Mismatch | ||
| #394 | Novelist | 30 | 475 | 158 | 1k+ | Output is not escaped | ||
| #395 | PitchPrint | 30 | 76 | 163 | 400 | Input is not sanitized | ||
| #396 | Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget | 30 | 231 | 102 | 1k+ | Non Singular String Literal Domain | ||
| #397 | Rublon Multi-Factor Authentication (MFA) | 30 | 216 | 160 | 400 | Output is not escaped | ||
| #398 | StoreBuild – Online Store Builder for WooCommerce | 30 | 120 | 211 | 600 | Non-prefixed global variable | ||
| #399 | Star Addons for Elementor | 30 | 236 | 255 | 1k+ | Non-prefixed global variable | ||
| #400 | Themify Portfolio Post | 30 | 214 | 102 | 30k+ | Text Domain Mismatch |
