Generic.PHP.ForbiddenFunctions.Found
Forbidden PHP function found
The plugin uses a PHP or WordPress pattern that coding standards discourage.
Why It Shows Up
Plugin Check found a discouraged function, forbidden function, goto, backtick operator, or similar construct.
Why It Matters
Discouraged patterns are often harder to review, less portable across hosts, or easier to misuse securely.
How to Fix
- Identify why the construct is used and whether WordPress provides a safer API.
- Replace shell execution, dynamic execution, or broad forbidden functions with constrained WordPress APIs.
- If a third-party library triggers the warning, isolate and document it.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #601 | Pure Metafields | 53 | 5 | 130 | 10k+ | Non-prefixed global variable | ||
| #602 | Royal WordPress Backup, Restore & Migration Plugin – Backup WordPress Sites Safely | 53 | 34 | 90 | 20k+ | Database parameter is not escaped | ||
| #603 | Widget Context | 53 | 14 | 20 | 40k+ | Non-prefixed hook name | ||
| #604 | WP Console – WordPress PHP Console powered by PsySH | 53 | 34 | 48 | 20k+ | Exception output is not escaped | ||
| #605 | Custom Category Templates | 54 | 11 | 11 | 3k+ | Unsafe printing function | ||
| #606 | Resize images before upload | 54 | 19 | 5 | 1k+ | Output is not escaped | ||
| #607 | Clean Archives Reloaded | 55 | 25 | 6 | 600 | Unsafe printing function | ||
| #608 | Head, Footer and Post Injections | 55 | 9 | 52 | 200k+ | Non-prefixed global variable | ||
| #609 | Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder | 55 | 54 | 692 | 700k+ | Non-prefixed hook name | ||
| #610 | Anti-Captcha (anti-spam botblocker) | 56 | 23 | 26 | 1k+ | rand mt rand | ||
| #611 | SMTP by BestWebSoft | 56 | 486 | 175 | 1k+ | Text Domain Mismatch | ||
| #612 | FluentSnippets – High-Performance Code Snippets, Header & Footer Code, Custom CSS & PHP Code Manager | 56 | 31 | 27 | 50k+ | Nonce verification recommended | ||
| #613 | Pantheon Migrations | 57 | 15 | 26 | 1k+ | Output is not escaped | ||
| #614 | BestWebSoft’s Pinterest | 57 | 490 | 176 | 500 | Text Domain Mismatch | ||
| #615 | Plugin Notes | 57 | 17 | 29 | 400 | Input is not validated | ||
| #616 | Random Post for Widget | 58 | 27 | 5 | 2k+ | Output is not escaped | ||
| #617 | Bandsintown Events | 60 | 80 | 28 | 4k+ | wp function not compatible with requires wp | ||
| #618 | Kubio AI Page Builder | 60 | 283 | 77 | 90k+ | Missing direct file access protection | ||
| #619 | Stratum Widgets for Elementor | 60 | 66 | 366 | 20k+ | Non-prefixed global variable | ||
| #620 | Text Domain Inspector | 61 | 41 | 36 | 400 | Non-prefixed global variable | ||
| #621 | Related Products Slider for WooCommerce – Boost Sales with Smart Product Recommendations | 61 | 81 | 13 | 1k+ | Text Domain Mismatch | ||
| #622 | Dashboard Widget Sidebar | 62 | 9 | 16 | 400 | Input is not validated | ||
| #623 | DreamHost Automated Migration | 62 | 15 | 23 | 20k+ | Output is not escaped | ||
| #624 | Migrate To Liquid Web & Nexcess | 62 | 15 | 23 | 2k+ | Output is not escaped | ||
| #625 | Pressable Automated Migration | 62 | 15 | 23 | 3k+ | Output is not escaped | ||
| #626 | Single Post Template | 62 | 14 | 8 | 4k+ | Text Domain Mismatch | ||
| #627 | Standard Widget Extensions | 62 | 67 | 6 | 1k+ | Output is not escaped | ||
| #628 | Migrate to WordPress.com | 62 | 15 | 28 | 2k+ | Output is not escaped | ||
| #629 | Email Post Changes | 63 | 43 | 8 | 500 | Missing Arg Domain | ||
| #630 | CV Demo Importer | 64 | 21 | 95 | 400 | Non-prefixed global variable | ||
| #631 | Page in Widget | 64 | 26 | 0 | 1k+ | Output is not escaped | ||
| #632 | PHP Code Widget | 64 | 22 | 1 | 80k+ | Output is not escaped | ||
| #633 | SMK Sidebar Generator | 64 | 19 | 5 | 10k+ | Output is not escaped | ||
| #634 | WP Search with Algolia | 64 | 26 | 16 | 7k+ | Exception output is not escaped | ||
| #635 | WP-Farsi | 65 | 26 | 36 | 600 | Non-prefixed function | ||
| #636 | Desert Companion | 68 | 412 | 837 | 20k+ | Non-prefixed global variable | ||
| #637 | WP Theme Changelogs | 68 | 13 | 18 | 900 | Nonce verification recommended | ||
| #638 | Smart WYSIWYG Blocks Of Content | 70 | 36 | 4 | 1k+ | Output is not escaped | ||
| #639 | ACF Enhanced Message Field | 71 | 29 | 1 | 600 | Text Domain Mismatch | ||
| #640 | Bold Timeline Lite | 71 | 220 | 561 | 10k+ | Non-prefixed global variable | ||
| #641 | Comfortable Reading | 71 | 16 | 8 | 2k+ | Output is not escaped | ||
| #642 | WP Widget in Navigation | 71 | 37 | 15 | 3k+ | Non Singular String Literal Domain | ||
| #643 | Starter Templates & Sites Pack by ThemeGrill | 72 | 28 | 51 | 70k+ | Non-prefixed hook name | ||
| #644 | Advanced Custom Fields – Widget Relationship Field add-on | 73 | 18 | 7 | 500 | Output is not escaped | ||
| #645 | Multifile Upload Field for Contact Form 7 | 73 | 41 | 7 | 5k+ | Text Domain Mismatch | ||
| #646 | Duplicate Widget | 74 | 17 | 0 | 1k+ | Output is not escaped | ||
| #647 | Widgets in Menu for WordPress | 74 | 16 | 12 | 8k+ | Text Domain Mismatch | ||
| #648 | PJ News Ticker | 75 | 13 | 14 | 3k+ | Output is not escaped | ||
| #649 | Tuxedo Responsive Widget Columns | 78 | 19 | 3 | 400 | Output is not escaped | ||
| #650 | WP Faster | 78 | 7 | 12 | 1k+ | trademarked term |
