PluginCheck.CodeAnalysis.WriteFile.ABSPATHDetected
ABSPATHDetected
The plugin writes files in or near plugin-controlled directories.
Why It Shows Up
Plugin Check found file creation or modification behavior that may affect the plugin directory or executable files.
Why It Matters
Runtime writes to plugin code directories can break updates, create permission issues, or introduce supply-chain risk.
How to Fix
- Store generated data in uploads, cache, or another WordPress-approved writable location.
- Validate paths and file names against strict allowlists.
- Avoid modifying plugin source files at runtime.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #51 | WP Job Portal – AI-Powered Recruitment System for Company or Job Board website | 24 | 78 | 1,168 | 8k+ | Missing Version | ||
| #52 | Export All Posts, Products, Orders & Users | WP Ultimate Exporter | WordPress CSV Export | 24 | 363 | 1,130 | 6k+ | Direct Query | ||
| #53 | AMP for WP – Accelerated Mobile Pages | 25 | 670 | 2,434 | 80k+ | Non-prefixed global variable | ||
| #54 | Breeze Cache | 25 | 219 | 801 | 400k+ | Non-prefixed global variable | ||
| #55 | FlatPM – Ad Manager, AdSense and Custom Code | 25 | 3,017 | 557 | 10k+ | Text Domain Mismatch | ||
| #56 | Index WP MySQL For Speed | 25 | 250 | 255 | 50k+ | Output is not escaped | ||
| #57 | BerqWP – All-In-One Optimization for Core Web Vitals, Cache, CDN, Images, CSS & JavaScript | 25 | 203 | 547 | 4k+ | Non-prefixed global variable | ||
| #58 | Sitemap by click5 | 25 | 286 | 132 | 6k+ | Unsafe printing function | ||
| #59 | Spectra Legacy – Gutenberg Blocks | 25 | 253 | 3,227 | 1m+ | Non-prefixed global variable | ||
| #60 | WP Encryption – Lifetime Free SSL Cert & HTTPS, Force SSL / HTTPS Redirect, SSL Security | 25 | 729 | 1,556 | 50k+ | Non-prefixed global variable | ||
| #61 | Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager | 26 | 113 | 597 | 90k+ | Non-prefixed global variable | ||
| #62 | ImageRecycle pdf & image compression | 27 | 329 | 204 | 1k+ | Text Domain Mismatch | ||
| #63 | LWS Optimize – All-in-One Speed Booster & Cache Tools | 27 | 35 | 534 | 10k+ | Non-prefixed global variable | ||
| #64 | WP Events Manager | 27 | 172 | 369 | 30k+ | Non-prefixed hook name | ||
| #65 | Easy HTTPS Redirection (SSL) | 29 | 266 | 152 | 100k+ | Unsafe printing function | ||
| #66 | Shiptastic for WooCommerce | 29 | 154 | 661 | 10k+ | Non-prefixed global variable | ||
| #67 | PitchPrint | 30 | 76 | 163 | 400 | Input is not sanitized | ||
| #68 | Taboola | 30 | 89 | 147 | 1k+ | Output is not escaped | ||
| #69 | Widget Manager Light | 30 | 233 | 83 | 600 | Text Domain Mismatch | ||
| #70 | Widgetize Pages Light | 30 | 145 | 104 | 3k+ | Output is not escaped | ||
| #71 | AEH Speed Optimization: Browser Cache, Optimized Minify, Lazy Loading & Image Optimization | 31 | 91 | 133 | 2k+ | Output is not escaped | ||
| #72 | Titan Anti-spam & Security – Brute Force Protection, 2FA & Spam Filter | 31 | 57 | 196 | 50k+ | Nonce verification recommended | ||
| #73 | Image Hotspot – Map Image Annotation | 31 | 95 | 287 | 3k+ | Non-prefixed global variable | ||
| #74 | LWS Tools | 31 | 104 | 134 | 10k+ | Request data is not unslashed | ||
| #75 | Patreon WordPress | 31 | 276 | 339 | 3k+ | Output is not escaped | ||
| #76 | AISEO | 31 | 646 | 205 | 1k+ | Text Domain Mismatch | ||
| #77 | Sidebar Manager Light | 31 | 221 | 76 | 1k+ | Text Domain Mismatch | ||
| #78 | SpeedyCache – Cache, Optimization, Performance | 31 | 65 | 118 | 600k+ | Input is not validated | ||
| #79 | Better Robots.txt – AI-Ready Crawl Control & Bot Governance | 32 | 55 | 83 | 5k+ | error log error log | ||
| #80 | Century ToolKit | 33 | 118 | 78 | 700 | Output is not escaped | ||
| #81 | LWSCache | 33 | 47 | 104 | 6k+ | Non-prefixed global variable | ||
| #82 | Telegram Bot & Channel | 33 | 182 | 113 | 600 | Unsafe printing function | ||
| #83 | WP EXtra – One Click Optimize | 33 | 414 | 101 | 6k+ | Missing Arg Domain | ||
| #84 | Debug Log Manager Tool | 34 | 44 | 143 | 3k+ | Nonce verification recommended | ||
| #85 | Gitium | 34 | 149 | 57 | 400 | Output is not escaped | ||
| #86 | Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid | 35 | 49 | 584 | 50k+ | Non-prefixed global variable | ||
| #87 | Cache Enabler | 35 | 44 | 75 | 90k+ | Input is not sanitized | ||
| #88 | Kiyoh customer review | 35 | 173 | 68 | 500 | Output is not escaped | ||
| #89 | Post List Featured Image | 35 | 112 | 100 | 900 | Output is not escaped | ||
| #90 | Push Notifications by LaraPush | 35 | 32 | 76 | 5k+ | Non-prefixed global variable | ||
| #91 | Analytics Spam Blocker | 37 | 76 | 22 | 800 | Unsafe printing function | ||
| #92 | Exploit Scanner | 37 | 25 | 130 | 8k+ | Non-prefixed global variable | ||
| #93 | 果果推送 | 37 | 31 | 56 | 1k+ | Nonce verification recommended | ||
| #94 | Images to WebP | 37 | 39 | 50 | 9k+ | curl curl setopt | ||
| #95 | Simple Image XML Sitemap | 37 | 119 | 16 | 1k+ | Output is not escaped | ||
| #96 | ThumbPress – Compress Images, Manage Thumbnails, Detect Image Issues, WebP/AVIF, Lazy Loading, Hotlinking & More | 38 | 20 | 92 | 30k+ | Direct Query | ||
| #97 | MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites | 38 | 5 | 136 | 700k+ | Non-prefixed hook name | ||
| #98 | Monetag Official Plugin | 38 | 133 | 32 | 5k+ | Text Domain Mismatch | ||
| #99 | Tag Manager – Header, Body And Footer | 38 | 97 | 319 | 20k+ | Non-prefixed global variable | ||
| #100 | WPTurbo -WordPress性能优化插件 | 38 | 20 | 34 | 700 | Output is not escaped |
