PluginCheck.CodeAnalysis.WriteFile.PluginDirectoryWrite
Plugin Directory Write
The plugin writes files in or near plugin-controlled directories.
Why It Shows Up
Plugin Check found file creation or modification behavior that may affect the plugin directory or executable files.
Why It Matters
Runtime writes to plugin code directories can break updates, create permission issues, or introduce supply-chain risk.
How to Fix
- Store generated data in uploads, cache, or another WordPress-approved writable location.
- Validate paths and file names against strict allowlists.
- Avoid modifying plugin source files at runtime.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #1 | BulletProof Security | 0 | 5,048 | 4,949 | 20k+ | Output is not escaped | ||
| #2 | Plugin Check (PCP) | 0 | 128 | 140 | 10k+ | Non-prefixed global variable | ||
| #3 | Themify Builder | 9 | 5,334 | 2,171 | 5k+ | Text Domain Mismatch | ||
| #4 | Efí Bank | 17 | 886 | 553 | 300 | Exception output is not escaped | ||
| #5 | WPtouch – Make your WordPress Website Mobile-Friendly | 17 | 1,466 | 325 | 50k+ | Text Domain Mismatch | ||
| #6 | Administrator Z | 18 | 2,061 | 799 | 400 | Output is not escaped | ||
| #7 | Shopping Cart & eCommerce Store | 18 | 8,240 | 18,478 | 3k+ | Non-prefixed global variable | ||
| #8 | WPPizza – A Restaurant Plugin | 18 | 4,689 | 2,703 | 1k+ | Text Domain Mismatch | ||
| #9 | Block Slider – Responsive Image Slider, Video Slider & Post Slider | 19 | 555 | 1,291 | 3k+ | Non-prefixed global variable | ||
| #10 | Go Fetch Jobs (for WP Job Manager) | 19 | 1,410 | 1,741 | 600 | Non-prefixed global variable | ||
| #11 | Matomo Analytics – Powerful, Privacy-First Insights for WordPress | 19 | 1,993 | 892 | 100k+ | Exception output is not escaped | ||
| #12 | Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) | 19 | 530 | 375 | 3m+ | Missing Translators Comment | ||
| #13 | Scrollsequence – Cinematic Scroll Image Animation Plugin | 19 | 878 | 1,528 | 3k+ | Non-prefixed global variable | ||
| #14 | SendPress Newsletters | 19 | 2,293 | 1,422 | 1k+ | Output is not escaped | ||
| #15 | WPQiNiu七牛云对象存储 | 19 | 138 | 612 | 400 | Non-prefixed global variable | ||
| #16 | Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) | 20 | 736 | 2,112 | 900 | Non-prefixed global variable | ||
| #17 | Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More | 20 | 2,879 | 1,979 | 1m+ | Non-prefixed global variable | ||
| #18 | Brevo – Email, SMS, Web Push, Chat, and more. | 20 | 460 | 646 | 100k+ | Request data is not unslashed | ||
| #19 | Microthemer Lite – Visual Editor to Customize CSS | 20 | 1,004 | 1,699 | 10k+ | Non-prefixed global variable | ||
| #20 | Powered Cache – Caching and Optimization for WordPress – Easily Improve PageSpeed & Web Vitals Score | 20 | 147 | 231 | 3k+ | Exception output is not escaped | ||
| #21 | Remove Add to Cart WooCommerce | 20 | 616 | 1,378 | 4k+ | Non-prefixed global variable | ||
| #22 | Restrict User Access – Ultimate Membership & Content Protection | 20 | 977 | 1,848 | 10k+ | Non-prefixed global variable | ||
| #23 | Events Manager – OpenStreetMaps | 20 | 559 | 444 | 600 | Output is not escaped | ||
| #24 | WP Compress – Instant Performance & Speed Optimization | 20 | 4,292 | 3,691 | 10k+ | Non Singular String Literal Domain | ||
| #25 | Backup Migration | 21 | 999 | 1,081 | 80k+ | Non-prefixed global variable | ||
| #26 | Kadence Security – Password, Two Factor Authentication, and Brute Force Protection | 21 | 1,060 | 959 | 700k+ | Missing Translators Comment | ||
| #27 | Captcha Them All | 21 | 300 | 323 | 5k+ | Output is not escaped | ||
| #28 | Comet Cache | 21 | 857 | 245 | 20k+ | Output is not escaped | ||
| #29 | DELUCKS SEO | 21 | 362 | 1,171 | 300 | Missing nonce verification | ||
| #30 | Directorist: AI-Powered Business Directory, Listings & Classified Ads | 21 | 484 | 2,327 | 20k+ | Non-prefixed global variable | ||
| #31 | Event Espresso – Event Registration & Ticketing Sales | 21 | 12,710 | 2,136 | 600 | Text Domain Mismatch | ||
| #32 | Feeds for YouTube (YouTube video, channel, and gallery plugin) | 21 | 503 | 995 | 100k+ | Output is not escaped | ||
| #33 | Leyka | 21 | 257 | 3,446 | 2k+ | Request data is not unslashed | ||
| #34 | Mapster WP Maps | 21 | 3,594 | 3,020 | 3k+ | Text Domain Mismatch | ||
| #35 | MultiParcels Shipping For WooCommerce | 21 | 245 | 426 | 4k+ | Request data is not unslashed | ||
| #36 | Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred | 21 | 1,436 | 3,345 | 10k+ | Non-prefixed global variable | ||
| #37 | Razorpay Quick Payments | 21 | 399 | 63 | 2k+ | Exception output is not escaped | ||
| #38 | Rocket Maintenance Mode & Coming Soon Page | 21 | 1,176 | 1,406 | 4k+ | Non-prefixed global variable | ||
| #39 | Royal Addons for Elementor – Addons and Templates Kit for Elementor | 21 | 12,997 | 2,344 | 600k+ | Text Domain Mismatch | ||
| #40 | SeatReg | 21 | 350 | 1,842 | 300 | Missing nonce verification | ||
| #41 | Trace My IP – Visitor IP Tracker, Stats Analytics & Page Views Counter with Email Alerts | 21 | 871 | 338 | 1k+ | wp function not compatible with requires wp | ||
| #42 | URL Shortify – Simple and Easy URL Shortener | 21 | 1,509 | 2,737 | 10k+ | Non-prefixed global variable | ||
| #43 | Buckaroo Payments for WooCommerce | 21 | 692 | 351 | 2k+ | Exception output is not escaped | ||
| #44 | BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages | 21 | 668 | 1,569 | 800 | Non-prefixed global variable | ||
| #45 | Wise Chat | 21 | 470 | 515 | 5k+ | Output is not escaped | ||
| #46 | Pay For Post with WooCommerce | 21 | 958 | 1,477 | 1k+ | Non-prefixed global variable | ||
| #47 | Wordfence Security – Firewall, Malware Scan, and Login Security | 21 | 1,893 | 3,292 | 5m+ | Output is not escaped | ||
| #48 | Frontend Admin by DynamiApps | 22 | 5,943 | 3,232 | 8k+ | Text Domain Mismatch | ||
| #49 | WP Sessions Time Monitoring Full Automatic | 22 | 869 | 1,529 | 500 | Non-prefixed global variable | ||
| #50 | Advanced Classifieds & Directory Pro | 22 | 1,229 | 3,513 | 2k+ | Non-prefixed global variable |
