PluginCheck.CodeAnalysis.WriteFile.PluginDirectoryWrite
Plugin Directory Write
The plugin writes files in or near plugin-controlled directories.
Why It Shows Up
Plugin Check found file creation or modification behavior that may affect the plugin directory or executable files.
Why It Matters
Runtime writes to plugin code directories can break updates, create permission issues, or introduce supply-chain risk.
How to Fix
- Store generated data in uploads, cache, or another WordPress-approved writable location.
- Validate paths and file names against strict allowlists.
- Avoid modifying plugin source files at runtime.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #551 | Goal Tracker – Custom Event Tracking for GA4 | 38 | 541 | 25 | 2k+ | Output is not escaped | ||
| #552 | HashThemes Demo Importer | 38 | 75 | 33 | 6k+ | Output is not escaped | ||
| #553 | Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin | 38 | 2 | 457 | 3k+ | Input is not sanitized | ||
| #554 | Simple Google Sitemap XML | 38 | 38 | 8 | 2k+ | Output is not escaped | ||
| #555 | Standout CSS3 Buttons | 38 | 183 | 15 | 500 | Output is not escaped | ||
| #556 | WP Safe Mode | 38 | 95 | 55 | 2k+ | Output is not escaped | ||
| #557 | Animate It! | 39 | 137 | 16 | 20k+ | Text Domain Mismatch | ||
| #558 | DefendWP Firewall | 39 | 16 | 203 | 3k+ | Non-prefixed global variable | ||
| #559 | Gutenverse News – News Blocks for Blog & Magazine Sites | 39 | 37 | 65 | 800 | Non-prefixed hook name | ||
| #560 | Rollbar | 39 | 75 | 14 | 400 | Output is not escaped | ||
| #561 | Sync Post With Other Site | 39 | 179 | 21 | 3k+ | Non Singular String Literal Domain | ||
| #562 | Salat Times | 40 | 235 | 20 | 500 | Output is not escaped | ||
| #563 | Visma Pay for Woocommerce | 40 | 27 | 37 | 1k+ | Output is not escaped | ||
| #564 | Visual Editor Custom Buttons | 40 | 30 | 48 | 4k+ | Output is not escaped | ||
| #565 | SNORDIAN's H5PxAPIkatchu | 41 | 119 | 88 | 500 | SQL query is not prepared | ||
| #566 | Simple Cache | 41 | 33 | 59 | 1k+ | Input is not sanitized | ||
| #567 | Wholesale for WooCommerce | 41 | 536 | 19 | 1k+ | Output is not escaped | ||
| #568 | Auto Coupons for WooCommerce | 42 | 82 | 68 | 4k+ | Output is not escaped | ||
| #569 | Automatic Responsive Tables | 43 | 67 | 15 | 1k+ | Output is not escaped | ||
| #570 | WP SmartCrop | 43 | 43 | 12 | 4k+ | Output is not escaped | ||
| #571 | Trusty Whistleblowing Solution | 44 | 234 | 16 | 400 | Text Domain Mismatch | ||
| #572 | Hyper Cache | 45 | 36 | 100 | 8k+ | Non-prefixed global variable | ||
| #573 | Tabby Checkout | 47 | 33 | 46 | 4k+ | Non-prefixed class | ||
| #574 | iControlWP | 47 | 45 | 59 | 1k+ | Missing direct file access protection | ||
| #575 | Compress, Resize & Lazy Load Images – WPvivid Image Optimization | 47 | 107 | 58 | 10k+ | Missing direct file access protection | ||
| #576 | SpinupWP | 49 | 43 | 38 | 30k+ | Non-prefixed function | ||
| #577 | Royal WordPress Backup, Restore & Migration Plugin – Backup WordPress Sites Safely | 53 | 34 | 90 | 30k+ | Database parameter is not escaped | ||
| #578 | Themeflection Numbers – Number Counter and Animated Numbers | 55 | 224 | 73 | 3k+ | Text Domain Mismatch | ||
| #579 | WP-Optimize – Cache, Compress images, Minify & Clean database to boost page speed & performance | 56 | 5 | 780 | 1m+ | Non-prefixed global variable | ||
| #580 | Surge | 60 | 46 | 47 | 4k+ | Non-prefixed global variable | ||
| #581 | CommerceBird – AI Command Center, ERP Integrations & B2B for WooCommerce (Zoho, Exact Online). | 61 | 2 | 162 | 400 | Direct Query | ||
| #582 | GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor | 61 | 7 | 119 | 80k+ | Non-prefixed global variable | ||
| #583 | SureDonation – Donation Forms, Fundraising Campaigns & Donor Management | 61 | 39 | 70 | 1k+ | Missing Arg Domain | ||
| #584 | Text Domain Inspector | 61 | 41 | 36 | 400 | Non-prefixed global variable | ||
| #585 | Newspack Newsletters | 62 | 53 | 45 | 1k+ | Request data is not unslashed | ||
| #586 | morkva UA Shipping | 64 | 1,305 | 21 | 1k+ | Text Domain Mismatch | ||
| #587 | Web and WooCommerce Addons for WPBakery Builder | 65 | 497 | 123 | 1k+ | Text Domain Mismatch | ||
| #588 | Easy PHP Settings | 66 | 34 | 48 | 1k+ | Missing Translators Comment | ||
| #589 | Meks Audio Player | 67 | 25 | 7 | 1k+ | Output is not escaped | ||
| #590 | Auto Update Post Date | 69 | 11 | 23 | 2k+ | Input is not validated | ||
| #591 | Upsell Funnel Builder for WooCommerce – Create Upsells, Cross-Sells, Order Bumps, Frequently Bought, and Popups. | 70 | 3 | 1,446 | 3k+ | Non-prefixed global variable | ||
| #592 | MemcacheD Is Your Friend | 72 | 23 | 33 | 1k+ | Non-prefixed function | ||
| #593 | Image Quality Control | Still BE | 72 | 83 | 26 | 400 | unlink unlink | ||
| #594 | Bestfreebie Elementor Icons | 73 | 27 | 13 | 400 | Text Domain Mismatch | ||
| #595 | Connect Contact Form 7 to Mailchimp, Brevo, MailerLite & Klaviyo | 74 | 579 | 84 | 40k+ | Text Domain Mismatch | ||
| #596 | LLMs.txt and LLMs-Full.txt Generator | 74 | 22 | 14 | 4k+ | Non-prefixed global variable | ||
| #597 | Styled Calendar – Customizable, Mobile Responsive Google Calendar Embeds | 75 | 8 | 8 | 1k+ | Exception output is not escaped | ||
| #598 | Change Mail Sender | 76 | 97 | 19 | 20k+ | Text Domain Mismatch | ||
| #599 | Responsive Mobile-Friendly Tooltip | 79 | 25 | 14 | 600 | Missing Arg Domain | ||
| #600 | Docxpresso | 80 | 9 | 14 | 2k+ | Input is not sanitized |
