PluginCheck.CodeAnalysis.WriteFile.PluginDirectoryWrite
Plugin Directory Write
The plugin writes files in or near plugin-controlled directories.
Why It Shows Up
Plugin Check found file creation or modification behavior that may affect the plugin directory or executable files.
Why It Matters
Runtime writes to plugin code directories can break updates, create permission issues, or introduce supply-chain risk.
How to Fix
- Store generated data in uploads, cache, or another WordPress-approved writable location.
- Validate paths and file names against strict allowlists.
- Avoid modifying plugin source files at runtime.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #501 | Garden Gnome Package | 34 | 116 | 51 | 4k+ | Text Domain Mismatch | ||
| #502 | Geliver Akıllı Kargo Pazaryeri | 34 | 49 | 247 | 400 | Non-prefixed global variable | ||
| #503 | Import XML and RSS Feeds | 34 | 260 | 85 | 2k+ | Unsafe printing function | ||
| #504 | Podigee WordPress Quick Publish – now with Gutenberg support! | 34 | 108 | 95 | 700 | Text Domain Mismatch | ||
| #505 | PushEngage – Web Push Notifications, WooCommerce Automation & Chat Widget | 34 | 46 | 298 | 9k+ | Missing nonce verification | ||
| #506 | PW WooCommerce Bulk Edit | 34 | 219 | 149 | 20k+ | Unsafe printing function | ||
| #507 | Wp Default Sender Email by IT Pixelz | 34 | 682 | 25 | 500 | Output is not escaped | ||
| #508 | WP Mail Logging | 34 | 76 | 258 | 300k+ | Nonce verification recommended | ||
| #509 | WP SendFox | 34 | 296 | 118 | 1k+ | Text Domain Mismatch | ||
| #510 | Xml Sitemap Generator | 34 | 72 | 47 | 400 | SQL query is not prepared | ||
| #511 | Embed Plus for YouTube Gallery, Livestream and Lazy Loading with Facades | 34 | 571 | 195 | 100k+ | Output is not escaped | ||
| #512 | Cache Enabler | 35 | 44 | 75 | 100k+ | Input is not sanitized | ||
| #513 | CompressX — AVIF & WebP Converter, Media Replacement | 35 | 34 | 424 | 40k+ | Missing nonce verification | ||
| #514 | Core Framework | 35 | 70 | 62 | 10k+ | Text Domain Mismatch | ||
| #515 | Create Block Theme | 35 | 43 | 5 | 20k+ | unlink unlink | ||
| #516 | Cryptex | E-Mail Address Protection | 35 | 62 | 10 | 900 | Output is not escaped | ||
| #517 | Easy Social Icons | 35 | 182 | 158 | 20k+ | Output is not escaped | ||
| #518 | Email Validator for Contact Form 7 | 35 | 111 | 74 | 500 | SQL query is not prepared | ||
| #519 | WP Rocket | Simple LoadCSS Preloader | 35 | 7 | 16 | 4k+ | Non-prefixed global variable | ||
| #520 | Windows Compatibility Fix | 35 | 13 | 6 | 1k+ | Plugin Directory Write | ||
| #521 | Instant CSS | 35 | 25 | 25 | 3k+ | Output is not escaped | ||
| #522 | LiteSpeed Cache | 35 | 282 | 889 | 7m+ | Non-prefixed global variable | ||
| #523 | FlexTable – Data Table Sync with Google Sheets | 35 | 20 | 78 | 4k+ | Direct Query | ||
| #524 | The Courier Guy Shipping for WooCommerce | 35 | 57 | 107 | 3k+ | Missing nonce verification | ||
| #525 | Embed videos and respect privacy | 35 | 6 | 11 | 2k+ | Non-prefixed global variable | ||
| #526 | ShipStation Live Rates for WooCommerce | 35 | 402 | 73 | 900 | Non Singular String Literal Domain | ||
| #527 | Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing | 35 | 50 | 237 | 40k+ | Non-prefixed hook name | ||
| #528 | WP Multilang – Translation and Multilingual Plugin | 35 | 22 | 102 | 10k+ | Database parameter is not escaped | ||
| #529 | WSB HUB3 | 35 | 36 | 109 | 1k+ | Missing nonce verification | ||
| #530 | Blaze Demo Importer | 36 | 101 | 94 | 8k+ | Output is not escaped | ||
| #531 | Booking Calendar | 36 | 50 | 259 | 50k+ | Mixed line endings | ||
| #532 | Dynamic Copyright Year | 36 | 972 | 43 | 800 | Output is not escaped | ||
| #533 | Microsoft Clarity | 36 | 53 | 168 | 200k+ | Nonce verification recommended | ||
| #534 | We’re Open! | 36 | 273 | 187 | 5k+ | Unsafe printing function | ||
| #535 | WP Coder – Insert & Manage Code Snippets | 36 | 53 | 280 | 10k+ | Nonce verification recommended | ||
| #536 | WPAvatar | 36 | 425 | 45 | 700 | Unsafe printing function | ||
| #537 | Analytics Spam Blocker | 37 | 76 | 22 | 800 | Unsafe printing function | ||
| #538 | Blogger Importer Extended | 37 | 55 | 59 | 4k+ | Output is not escaped | ||
| #539 | Disclaimer Popup | 37 | 313 | 53 | 1k+ | Text Domain Mismatch | ||
| #540 | Easy Photo Album | 37 | 360 | 43 | 1k+ | Text Domain Mismatch | ||
| #541 | Injection Guard | 37 | 86 | 45 | 1k+ | Unsafe printing function | ||
| #542 | RSS Image Feed | 37 | 147 | 16 | 2k+ | Output is not escaped | ||
| #543 | Tilopay | 37 | 35 | 130 | 2k+ | Nonce verification recommended | ||
| #544 | WPForce Logout – WordPress User Login Logout Management Plugin | 37 | 567 | 32 | 8k+ | Output is not escaped | ||
| #545 | WP Post Signature | 37 | 90 | 13 | 1k+ | Unsafe printing function | ||
| #546 | TopNewsWp – Display Tikcer News, RSS Feed Widget and Many More | 37 | 878 | 59 | 800 | Output is not escaped | ||
| #547 | Admin Bar & Dashboard Access Control | 38 | 94 | 37 | 3k+ | Text Domain Mismatch | ||
| #548 | Audio Story Images | 38 | 46 | 44 | 400 | Output is not escaped | ||
| #549 | Car Route Planner Plugin | 38 | 135 | 17 | 400 | Output is not escaped | ||
| #550 | CRUDLab Disable Comments | 38 | 20 | 54 | 700 | Missing nonce verification |
