Generic.PHP.ForbiddenFunctions.Found
Forbidden PHP function found
The plugin uses a PHP or WordPress pattern that coding standards discourage.
Why It Shows Up
Plugin Check found a discouraged function, forbidden function, goto, backtick operator, or similar construct.
Why It Matters
Discouraged patterns are often harder to review, less portable across hosts, or easier to misuse securely.
How to Fix
- Identify why the construct is used and whether WordPress provides a safer API.
- Replace shell execution, dynamic execution, or broad forbidden functions with constrained WordPress APIs.
- If a third-party library triggers the warning, isolate and document it.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #551 | Recent & Featured Posts Widget | 40 | 124 | 2 | 600 | Output is not escaped | ||
| #552 | Responsive Sidebar | 40 | 43 | 12 | 700 | Output is not escaped | ||
| #553 | Contact Info Widget | 40 | 184 | 3 | 1k+ | Output is not escaped | ||
| #554 | Simple Page Sidebars | 40 | 55 | 65 | 20k+ | Output is not escaped | ||
| #555 | Thin Out Revisions | 40 | 93 | 35 | 800 | Non Singular String Literal Domain | ||
| #556 | Tumblr Widget | 40 | 106 | 1 | 400 | Output is not escaped | ||
| #557 | Widgets Control | 40 | 92 | 47 | 800 | Output is not escaped | ||
| #558 | AMP for WP – Accelerated Mobile Pages | 41 | 656 | 2,401 | 80k+ | Non-prefixed global variable | ||
| #559 | Auto Focus Keyword for SEO | 41 | 12 | 38 | 2k+ | Input is not validated | ||
| #560 | Bulk Auto Image Title Attribute (Image Title tag) optimizer (Image SEO) | 41 | 16 | 37 | 1k+ | Missing nonce verification | ||
| #561 | Category Wise Search | 41 | 58 | 9 | 500 | Output is not escaped | ||
| #562 | My Favorites | 41 | 35 | 34 | 1k+ | Output is not escaped | ||
| #563 | Revision Control | 41 | 60 | 28 | 40k+ | Output is not escaped | ||
| #564 | Simple Lightbox | 41 | 21 | 48 | 100k+ | Nonce verification recommended | ||
| #565 | Squeeze – Image Optimization & Compression, WEBP Conversion | 41 | 20 | 70 | 2k+ | Nonce verification recommended | ||
| #566 | WP Crontrol | 41 | 20 | 91 | 300k+ | Nonce verification recommended | ||
| #567 | Dashboard Notes | 42 | 27 | 34 | 600 | Missing Arg Domain | ||
| #568 | FooTable | 42 | 86 | 7 | 1k+ | Output is not escaped | ||
| #569 | Simple Googlebot Visit | 42 | 32 | 67 | 1k+ | Non Singular String Literal Domain | ||
| #570 | WPTerm | 42 | 61 | 89 | 3k+ | Output is not escaped | ||
| #571 | Floating Awesome Button (Sticky Button, Popup, Toast) & 200+ Website Custom Interactive Element | 43 | 66 | 109 | 800 | Missing direct file access protection | ||
| #572 | Pro Categories Widget | 43 | 59 | 9 | 800 | Output is not escaped | ||
| #573 | WP Mail Log | 43 | 40 | 29 | 10k+ | Text Domain Mismatch | ||
| #574 | Code Widget | 44 | 60 | 33 | 4k+ | Text Domain Mismatch | ||
| #575 | Comment Image | 44 | 19 | 23 | 1k+ | Output is not escaped | ||
| #576 | Debug Bar Console | 44 | 23 | 9 | 1k+ | Missing Arg Domain | ||
| #577 | WP Club Manager – WordPress Sports Club Plugin | 44 | 171 | 682 | 600 | Non-prefixed global variable | ||
| #578 | Icons Font Loader – Load Web Fonts and Icon Libraries | 45 | 47 | 33 | 2k+ | Text Domain Mismatch | ||
| #579 | Jetpack Search | 45 | 925 | 426 | 5k+ | Text Domain Mismatch | ||
| #580 | SyntaxHighlighter Evolved | 45 | 33 | 46 | 20k+ | Not In Footer | ||
| #581 | Pinterest Pinboard Widget | 46 | 54 | 4 | 500 | Output is not escaped | ||
| #582 | Repeater Fields for Gravity Forms | 46 | 134 | 41 | 1k+ | wp function not compatible with requires wp | ||
| #583 | Stars Rating | 46 | 13 | 34 | 1k+ | Missing nonce verification | ||
| #584 | Granular Controls For Elementor | 47 | 56 | 4 | 10k+ | Output is not escaped | ||
| #585 | Social Media Widget | 47 | 51 | 3 | 400 | Output is not escaped | ||
| #586 | Compress, Resize & Lazy Load Images – WPvivid Image Optimization | 47 | 107 | 58 | 10k+ | Missing direct file access protection | ||
| #587 | Ansar Import – One Click Starter Sites – for Elementor & Themes | 48 | 27 | 116 | 10k+ | Non-prefixed global variable | ||
| #588 | Jetpack Social | 48 | 829 | 254 | 30k+ | Text Domain Mismatch | ||
| #589 | Easy Updates Manager | 48 | 13 | 182 | 300k+ | Non-prefixed global variable | ||
| #590 | Batcache | 49 | 12 | 53 | 700 | Input is not sanitized | ||
| #591 | Drag and Drop Multiple File Upload for WooCommerce | 49 | 114 | 29 | 5k+ | Text Domain Mismatch | ||
| #592 | HT Feed | 49 | 76 | 11 | 700 | Output is not escaped | ||
| #593 | Logo Carousel Slider | 49 | 102 | 14 | 6k+ | Non Singular String Literal Domain | ||
| #594 | Responsive Image Widget | 49 | 43 | 0 | 500 | Output is not escaped | ||
| #595 | IMGspider – 图片采集抓取插件 | 50 | 12 | 49 | 2k+ | Missing nonce verification | ||
| #596 | BestWebSoft's Twitter | 50 | 477 | 174 | 900 | Text Domain Mismatch | ||
| #597 | Cart Popup for WooCommerce | 51 | 9 | 115 | 9k+ | Non-prefixed global variable | ||
| #598 | Quotes and Tips by BestWebSoft | 51 | 485 | 190 | 1k+ | Text Domain Mismatch | ||
| #599 | Custom Post Template By Templatic | 52 | 19 | 14 | 600 | Text Domain Mismatch | ||
| #600 | MOBILOOK — Mobile View & Mobile‑Friendly Test | 53 | 10 | 20 | 1k+ | Missing nonce verification |
