PluginScore

PluginCheck.CodeAnalysis.WriteFile.PluginDirectoryWrite

Plugin Directory Write

The plugin writes files in or near plugin-controlled directories.

medium weight

Why It Shows Up

Plugin Check found file creation or modification behavior that may affect the plugin directory or executable files.

Why It Matters

Runtime writes to plugin code directories can break updates, create permission issues, or introduce supply-chain risk.

How to Fix

  • Store generated data in uploads, cache, or another WordPress-approved writable location.
  • Validate paths and file names against strict allowlists.
  • Avoid modifying plugin source files at runtime.

References

WordPress Filesystem API

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#51Advanced Classifieds & Directory Pro221,2293,5122k+Non-prefixed global variable
#52All-in-One Video Gallery229112,89220k+Non-prefixed global variable
#53Backup Bolt225801,313800Non-prefixed global variable
#54Knowledge Base documentation & wiki plugin – BasePress Docs226711,7672k+Non-prefixed global variable
#55Cleanup Action Scheduler225451,3061k+Non-prefixed global variable
#56Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer222,8541,26950k+Text Domain Mismatch
#57Code Profiler – WordPress Performance Profiling and Debugging Made Easy222654008k+Non-prefixed global variable
#58Passster – Password Protect Pages and Content225391,42210k+Non-prefixed global variable
#59Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates222,3924,2907k+Non-prefixed global variable
#60Database Access with Adminer229832,5531k+Non-prefixed global variable
#61Directorist: AI-Powered Business Directory, Listings & Classified Ads225602,20220k+Non-prefixed global variable
#62DirectoryPress – Business Directory And Classified Ad Listing224,7872,795700Text Domain Mismatch
#63Ebook Store224101,054700Non-prefixed global variable
#64EleSpare – News, Magazine and Blog Addons for Elementor227331,42310k+Non-prefixed global variable
#65Notification Bar, Announcement and Cookie Notice WordPress Plugin – FooBar221,3211,3713k+Non-prefixed global variable
#66Hesabfa Accounting22467718500Text Domain Mismatch
#67Insert or Embed Articulate Content into WordPress226591,4372k+Non-prefixed global variable
#68Jim Soft Swiss QR Invoice22263392400Non-prefixed global variable
#69Custom Login Page Customizer – Login Designer225881,45530k+Non-prefixed global variable
#70MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.222,6252,45810k+Output is not escaped
#71Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization221,3062,8188k+Output is not escaped
#72myCred Addons – Ultimate myCred Modules To Support WordPress Gamification and Loyalty Rewards222,3441,320400Output is not escaped
#73NinjaFirewall (WP Edition) – Advanced Security Plugin and Firewall221,2722,063100k+Non-prefixed global variable
#74NinjaScanner – Virus & Malware scan2259655130k+Non-prefixed global variable
#75Packeta228013338k+Exception output is not escaped
#76Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App221,5812,326300k+Non-prefixed global variable
#77PageSpeed Ninja – Cache, Minify, Defer CSS JavaScript, Critical CSS, Optimize Images, Convert WebP229844075k+Unsafe printing function
#78Restrict User Access – Ultimate Membership & Content Protection229771,84010k+Non-prefixed global variable
#79Social Sharing Plugin – Sassy Social Share221,689233100k+wp function not compatible with requires wp
#80Seraphinite Accelerator2259525550k+Output is not escaped
#81Slick Popup: Contact Form 7 Popup Plugin222,3223161k+Text Domain Mismatch
#82SNS Count Cache229181207k+Non Singular String Literal Domain
#83SSL Zen — SSL Certificate Installer & HTTPS Redirects227511,60510k+Non-prefixed global variable
#84SVG Flags – Beautiful Scalable Flags For All Countries!227551,2512k+Non-prefixed global variable
#85The Moneytizer227512711k+Text Domain Mismatch
#86Theme Editor2279868550k+Output is not escaped
#87Ultimate Carousel For Divi225901,566800Non-prefixed global variable
#88Ultimeter227511,3441k+Non-prefixed global variable
#89Uncanny Toolkit for LearnDash2253999420k+Output is not escaped
#90Unlimited Elements Blocks Library227081,822400Non-prefixed global variable
#91RapidLoad AI – Optimize Web Vitals Automatically2281840700Nonce verification recommended
#92Search & Replace Everything – Quick and Easy Way to Find and Replace Text, Links221,0441,79720k+Non-prefixed global variable
#93Welcart e-Commerce2210,37610,93610k+Text Domain Mismatch
#94Walker Core221,3511,436800Non-prefixed global variable
#95Easy Appointment Booking & Scheduling System – Webba Booking Calendar221,6173,3802k+Non-prefixed global variable
#96Fraud Prevention For WooCommerce and EDD225721,3945k+Non-prefixed global variable
#97WP Affiliate Disclosure221,3581,5041k+Non-prefixed global variable
#98Master Accordion ( Former WP Awesome FAQ Plugin )221,7741,286700Non-prefixed global variable
#99WP Umbrella: Security Backup Restore & Monitoring2297099980k+Exception output is not escaped
#100NotifSMS – SMS Notifications OTP & 2FA for WordPress & WooCommerce221,3531,4121k+Non-prefixed global variable