PluginCheck.CodeAnalysis.WriteFile.PluginDirectoryWrite
Plugin Directory Write
The plugin writes files in or near plugin-controlled directories.
Why It Shows Up
Plugin Check found file creation or modification behavior that may affect the plugin directory or executable files.
Why It Matters
Runtime writes to plugin code directories can break updates, create permission issues, or introduce supply-chain risk.
How to Fix
- Store generated data in uploads, cache, or another WordPress-approved writable location.
- Validate paths and file names against strict allowlists.
- Avoid modifying plugin source files at runtime.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #451 | WPBase Cache | 27 | 189 | 113 | 2k+ | Text Domain Mismatch | ||
| #452 | Maspik – Ultimate Spam Protection | 28 | 212 | 862 | 30k+ | Missing nonce verification | ||
| #453 | Embedder for Google Reviews | 28 | 531 | 1,333 | 6k+ | Non-prefixed global variable | ||
| #454 | Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin | 28 | 121 | 135 | 3k+ | Non-prefixed global variable | ||
| #455 | Flipa PDF Flipbook | 28 | 525 | 1,289 | 700 | Non-prefixed global variable | ||
| #456 | Reviews and Rating – Google Reviews | 28 | 343 | 219 | 20k+ | Text Domain Mismatch | ||
| #457 | گیتلند | درگاه پرداخت هوشمند گیتلند | 28 | 327 | 235 | 3k+ | Output is not escaped | ||
| #458 | Photo Gallery – GT3 Image Gallery & Gutenberg Block Gallery | 28 | 384 | 175 | 10k+ | Text Domain Mismatch | ||
| #459 | افزونه حمل و نقل ووکامرس | پست پیشتاز، تیپاکس و پیک موتوری | 28 | 131 | 190 | 20k+ | Missing nonce verification | ||
| #460 | PushAlert – Web Push Notifications for WordPress and WooCommerce | 28 | 196 | 63 | 1k+ | curl curl setopt | ||
| #461 | Sparkle Demo Importer | 28 | 307 | 166 | 5k+ | Text Domain Mismatch | ||
| #462 | WP YouTube Lyte | 28 | 205 | 178 | 20k+ | Non-prefixed global variable | ||
| #463 | WP Synchro – The Ultimate WordPress Migration Tool | 28 | 243 | 244 | 2k+ | Missing Translators Comment | ||
| #464 | Plugin BlueX for WooCommerce | 29 | 430 | 216 | 2k+ | Text Domain Mismatch | ||
| #465 | Branded Social Images – Open Graph Images with logo and extra text layer | 29 | 254 | 91 | 900 | Non Singular String Literal Domain | ||
| #466 | DB Cache Reloaded Fix | 29 | 133 | 42 | 2k+ | Output is not escaped | ||
| #467 | Everest Toolkit | 29 | 145 | 141 | 1k+ | Missing Translators Comment | ||
| #468 | Jetpack Boost – Website Speed, Performance and Critical CSS | 29 | 659 | 247 | 200k+ | Text Domain Mismatch | ||
| #469 | Extra Product Options Builder for WooCommerce | 30 | 112 | 210 | 2k+ | Non-prefixed global variable | ||
| #470 | OoohBoi Steroids for Elementor | 30 | 2,059 | 100 | 40k+ | Text Domain Mismatch | ||
| #471 | QA Assistants – Driven by data | 30 | 4 | 867 | 2k+ | Non-prefixed global variable | ||
| #472 | AI Builder – Generate pages, blocks, images & translate with AI | 31 | 101 | 194 | 500 | Non-prefixed global variable | ||
| #473 | AI ChatBot with ChatGPT and Content Generator by AYS | 31 | 170 | 378 | 400 | Non-prefixed global variable | ||
| #474 | Thanh Toán Quét Mã QR Code Tự Động – MoMo, ViettelPay, VNPay và 40 ngân hàng Việt Nam | 31 | 598 | 70 | 600 | Text Domain Mismatch | ||
| #475 | České služby pro WordPress | 31 | 95 | 139 | 1k+ | Output is not escaped | ||
| #476 | Download Plugin | 31 | 78 | 102 | 60k+ | Output is not escaped | ||
| #477 | g-FFL Checkout | 31 | 249 | 300 | 700 | Request data is not unslashed | ||
| #478 | Image Hotspot – Map Image Annotation | 31 | 95 | 287 | 3k+ | Non-prefixed global variable | ||
| #479 | Linguise – AI Automatic Multilingual Translation | 31 | 61 | 284 | 1k+ | Non-prefixed global variable | ||
| #480 | Openpay Stores Plugin | 31 | 121 | 75 | 1k+ | Non-prefixed global variable | ||
| #481 | SmartBill Facturare si Gestiune | 31 | 421 | 164 | 5k+ | Text Domain Mismatch | ||
| #482 | SpeedyCache – Cache, Optimization, Performance | 31 | 65 | 118 | 600k+ | Input is not validated | ||
| #483 | WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More | 31 | 167 | 332 | 5m+ | Non-prefixed global variable | ||
| #484 | Zendesk Support for WordPress | 31 | 195 | 88 | 2k+ | Output is not escaped | ||
| #485 | ACME Divi Modules | 32 | 573 | 35 | 400 | Text Domain Mismatch | ||
| #486 | Admin Menu Editor | 32 | 159 | 233 | 300k+ | Non-prefixed global variable | ||
| #487 | Translate WordPress with GTranslate | 32 | 82 | 364 | 900k+ | Non-prefixed global variable | ||
| #488 | WP Mobile Menu – The Mobile-Friendly Responsive Menu | 32 | 990 | 195 | 70k+ | Output is not escaped | ||
| #489 | TK Google Fonts GDPR Compliant | 32 | 582 | 34 | 1k+ | Output is not escaped | ||
| #490 | Multi Currency For WooCommerce | 32 | 87 | 70 | 1k+ | Non-prefixed global variable | ||
| #491 | WT GeoTargeting | 32 | 89 | 43 | 1k+ | Output is not escaped | ||
| #492 | Advanced Custom Fields: Typography Field | 33 | 445 | 57 | 3k+ | Text Domain Mismatch | ||
| #493 | Cargus | 33 | 48 | 64 | 700 | Input is not sanitized | ||
| #494 | Chartify – WordPress Chart Plugin | 33 | 76 | 411 | 3k+ | Non-prefixed global variable | ||
| #495 | Human Presence – Stop Form Spam Without ReCaptcha | 33 | 54 | 65 | 1k+ | Request data is not unslashed | ||
| #496 | WP Twitter Auto Publish | 33 | 442 | 171 | 4k+ | Output is not escaped | ||
| #497 | Multi-Carrier EasyPost Shipping Methods & Address Validation for WooCommerce | 33 | 424 | 69 | 400 | Non Singular String Literal Domain | ||
| #498 | Multi-Carrier Shippo Shipping Rates & Address Validation for WooCommerce | 33 | 411 | 73 | 3k+ | Non Singular String Literal Domain | ||
| #499 | XML Sitemaps | 33 | 65 | 62 | 2k+ | Output is not escaped | ||
| #500 | Document Library Lite | 34 | 159 | 96 | 4k+ | Text Domain Mismatch |
