Supply Chain Issues
Issue Codes
3 normalized finding codes in this category.
Hidden files included
hidden_files
The plugin package contains hidden files or directories that usually should not ship in a WordPress.org release.
Compressed files included
compressed_files
The plugin package contains nested archives or compressed files.
Obfuscated code detected
obfuscated_code_detected
The plugin contains code that appears intentionally hard to read or review.
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #401 | Dropify | 30 | 132 | 254 | 2k+ | Nonce verification recommended | ||
| #402 | zahls.ch Credit Cards, PostFinance and TWINT for WooCommerce | 30 | 121 | 265 | 3k+ | Non-prefixed global variable | ||
| #403 | ActiveCampaign – The autonomous marketing platform | 31 | 235 | 98 | 40k+ | Output is not escaped | ||
| #404 | AI Builder – Generate pages, blocks, images & translate with AI | 31 | 101 | 194 | 500 | Non-prefixed global variable | ||
| #405 | All-in-one contact buttons – WPSHARE247 | 31 | 108 | 113 | 4k+ | Non-prefixed global variable | ||
| #406 | Titan Anti-spam & Security – Brute Force Protection, 2FA & Spam Filter | 31 | 57 | 196 | 50k+ | Nonce verification recommended | ||
| #407 | Яндекс Доставка (Boxberry) | 31 | 46 | 150 | 500 | Missing nonce verification | ||
| #408 | Export Order Items for WooCommerce | 31 | 100 | 108 | 1k+ | Text Domain Mismatch | ||
| #409 | Express Checkout via PayPal for WooCommerce | 31 | 158 | 200 | 800 | Nonce verification recommended | ||
| #410 | OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. | 31 | 213 | 62 | 300k+ | Output is not escaped | ||
| #411 | Mailgun for WordPress | 31 | 144 | 75 | 80k+ | Unsafe printing function | ||
| #412 | Push notification for Mobile and Web app | 31 | 87 | 83 | 400 | Non Singular String Literal Domain | ||
| #413 | reCAPTCHA in WP comments form | 31 | 264 | 60 | 8k+ | Output is not escaped | ||
| #414 | SmartBill Facturare si Gestiune | 31 | 421 | 164 | 5k+ | Text Domain Mismatch | ||
| #415 | Staatic – Static Site Generator for WordPress | 31 | 420 | 195 | 2k+ | SQL query is not prepared | ||
| #416 | Themify Store Locator | 31 | 244 | 125 | 500 | Text Domain Mismatch | ||
| #417 | Worldline Global Online Pay for WooCommerce | 31 | 160 | 86 | 500 | Missing direct file access protection | ||
| #418 | WPGatsby | 31 | 125 | 55 | 3k+ | Text Domain Mismatch | ||
| #419 | WP Simple Booking Calendar | 31 | 337 | 380 | 20k+ | Output is not escaped | ||
| #420 | One to one user Chat by WPGuppy | 31 | 74 | 187 | 700 | Non-prefixed global variable | ||
| #421 | Admin Menu Editor | 32 | 159 | 233 | 300k+ | Non-prefixed global variable | ||
| #422 | AI Alt Text Generator | 32 | 76 | 24 | 1k+ | Missing Translators Comment | ||
| #423 | BP Classic | 32 | 664 | 216 | 6k+ | Unsafe printing function | ||
| #424 | Color and Image Swatches for Variable Product Attributes | 32 | 173 | 111 | 900 | Output is not escaped | ||
| #425 | Enter Addons – Ultimate Template Builder for Elementor | 32 | 82 | 72 | 1k+ | Output is not escaped | ||
| #426 | MetaSlider Gallery – Image Gallery, Lightbox Galleries, Modal Windows | 32 | 159 | 62 | 10k+ | Output is not escaped | ||
| #427 | Mollie Payments for WooCommerce | 32 | 71 | 134 | 100k+ | Dynamic hook name | ||
| #428 | Post and Page Builder by BoldGrid – Visual Drag and Drop Editor | 32 | 348 | 258 | 50k+ | Output is not escaped | ||
| #429 | Posti Shipping | 32 | 664 | 157 | 1k+ | Text Domain Mismatch | ||
| #430 | Simple Ajax Chat – Add a Fast, Secure Chat Box | 32 | 107 | 266 | 2k+ | Output is not escaped | ||
| #431 | Subscribe2 – Form, Email Subscribers & Newsletters | 32 | 32 | 410 | 10k+ | Direct Query | ||
| #432 | User Registration Using Contact Form 7 | 32 | 103 | 15 | 500 | wp function not compatible with requires wp | ||
| #433 | Multi Currency For WooCommerce | 32 | 87 | 70 | 1k+ | Non-prefixed global variable | ||
| #434 | WooMS | 32 | 199 | 58 | 500 | Output is not escaped | ||
| #435 | WP fail2ban – Advanced Security | 32 | 75 | 153 | 60k+ | Dynamic hook name | ||
| #436 | App Builder – Create Native Android & iOS Apps On The Flight | 33 | 73 | 119 | 600 | Text Domain Mismatch | ||
| #437 | Bosta WooCommerce | 33 | 303 | 180 | 700 | Text Domain Mismatch | ||
| #438 | CartPops – High Converting Add To Cart Popup For WooCommerce | 33 | 63 | 188 | 4k+ | Non-prefixed global variable | ||
| #439 | CB Custom Beaver Builder Modules | 33 | 748 | 4 | 1k+ | Output is not escaped | ||
| #440 | Conekta Payment Gateway | 33 | 240 | 66 | 2k+ | Text Domain Mismatch | ||
| #441 | Countdown Timer | 33 | 311 | 17 | 900 | Text Domain Mismatch | ||
| #442 | Fastly | 33 | 221 | 66 | 1k+ | Text Domain Mismatch | ||
| #443 | GDPR Cookie Compliance – Cookie Banner, Cookie Consent, Cookie Notice for CCPA, EU Cookie Law | 33 | 47 | 382 | 300k+ | Non-prefixed global variable | ||
| #444 | Ultimate Addons for Elementor | 33 | 81 | 291 | 2m+ | Non-prefixed class | ||
| #445 | InPost Gallery | 33 | 105 | 245 | 700 | Non-prefixed global variable | ||
| #446 | WPZOOM Social Feed Widget & Block | 33 | 310 | 278 | 60k+ | Unsafe printing function | ||
| #447 | jQuery Manager for WordPress | 33 | 86 | 24 | 7k+ | Output is not escaped | ||
| #448 | Logo Showcase Ultimate – Logo Carousel, Logo Slider & Logo Grid | 33 | 274 | 106 | 3k+ | Text Domain Mismatch | ||
| #449 | Payflex Payment Gateway | 33 | 181 | 61 | 1k+ | Text Domain Mismatch | ||
| #450 | PeproDev WooCommerce Receipt Uploader | 33 | 325 | 49 | 1k+ | Non Singular String Literal Domain |
