PluginScore

PluginCheck.CodeAnalysis.WriteFile.PluginDirectoryWrite

Plugin Directory Write

The plugin writes files in or near plugin-controlled directories.

medium weight

Why It Shows Up

Plugin Check found file creation or modification behavior that may affect the plugin directory or executable files.

Why It Matters

Runtime writes to plugin code directories can break updates, create permission issues, or introduce supply-chain risk.

How to Fix

  • Store generated data in uploads, cache, or another WordPress-approved writable location.
  • Validate paths and file names against strict allowlists.
  • Avoid modifying plugin source files at runtime.

References

WordPress Filesystem API

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#1BulletProof Security05,0484,94920k+Output is not escaped
#2Plugin Check (PCP)012813210k+Exception output is not escaped
#3Themify Builder95,3042,1365k+Text Domain Mismatch
#4Efí Bank17886553400Exception output is not escaped
#5WPtouch – Make your WordPress Website Mobile-Friendly171,46632550k+Text Domain Mismatch
#6Property Hive181,9576,0273k+Missing nonce verification
#7Realtyna Organic IDX plugin + WPL Real Estate189303,6362k+Non-prefixed global variable
#8Shopping Cart & eCommerce Store185,37317,4663k+Non-prefixed global variable
#9WPPizza – A Restaurant Plugin184,6892,7031k+Text Domain Mismatch
#10Block Slider – Responsive Image Slider, Video Slider & Post Slider195551,2913k+Non-prefixed global variable
#11Go Fetch Jobs (for WP Job Manager)191,4101,741700Non-prefixed global variable
#12Matomo Analytics – Powerful, Privacy-First Insights for WordPress191,900877100k+Exception output is not escaped
#13Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)195363793m+Missing Translators Comment
#14Scrollsequence – Cinematic Scroll Image Animation Plugin198781,5284k+Non-prefixed global variable
#15SendPress Newsletters192,2931,4221k+Output is not escaped
#16WPQiNiu七牛云对象存储19138612400Non-prefixed global variable
#17Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC)207362,112900Non-prefixed global variable
#18Event Espresso – Event Registration & Ticketing Sales2012,6982,135600Text Domain Mismatch
#19Brevo – Email, SMS, Web Push, Chat, and more.20460646100k+Request data is not unslashed
#20Microthemer Lite – Visual Editor to Customize CSS201,0041,69910k+Non-prefixed global variable
#21Powered Cache – Caching and Optimization for WordPress – Easily Improve PageSpeed & Web Vitals Score201472313k+Exception output is not escaped
#22Remove Add to Cart WooCommerce206161,3784k+Non-prefixed global variable
#23Events Manager – OpenStreetMaps20559444700Output is not escaped
#24Backup Migration219811,09380k+Non-prefixed global variable
#25Kadence Security – Password, Two Factor Authentication, and Brute Force Protection211,060957700k+Missing Translators Comment
#26Captcha Them All213003235k+Output is not escaped
#27SMS Extension for Contact Form 7217201,387400Non-prefixed global variable
#28Comet Cache2185724520k+Output is not escaped
#29Daily Prayer Time219471,7801k+Non-prefixed global variable
#30DELUCKS SEO213621,171400Missing nonce verification
#31Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More212,5721,2771m+Output is not escaped
#32Feeds for YouTube (YouTube video, channel, and gallery plugin)21558978100k+Output is not escaped
#33Leyka212573,4462k+Request data is not unslashed
#34Mapster WP Maps213,4402,8943k+Text Domain Mismatch
#35Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred211,4783,33710k+Non-prefixed global variable
#36Razorpay Quick Payments21399632k+Exception output is not escaped
#37Rocket Maintenance Mode & Coming Soon Page211,1761,4064k+Non-prefixed global variable
#38Royal Addons for Elementor – Addons and Templates Kit for Elementor2113,0112,530600k+Text Domain Mismatch
#39SeatReg213121,637400Missing nonce verification
#40Trace My IP – Visitor IP Tracker, Stats Analytics & Page Views Counter with Email Alerts218713381k+wp function not compatible with requires wp
#41URL Shortify – Simple and Easy URL Shortener211,5112,66910k+Non-prefixed global variable
#42Buckaroo Woocommerce Payments Plugin216383212k+Exception output is not escaped
#43BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages216681,569800Non-prefixed global variable
#44Wise Chat214705065k+Output is not escaped
#45Paysera Payment Gateway for WooCommerce211,8681967k+Exception output is not escaped
#46Pay For Post with WooCommerce219581,4771k+Non-prefixed global variable
#47Wordfence Security – Firewall, Malware Scan, and Login Security211,5922,9735m+Output is not escaped
#48WP Compress – Instant Performance & Speed Optimization213,3673,25310k+Non Singular String Literal Domain
#4912 Step Meeting List22156593900Non-prefixed global variable
#50WP Sessions Time Monitoring Full Automatic228691,529500Non-prefixed global variable