WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound
Non-prefixed global variable
The plugin defines a global variable without a plugin-specific prefix.
Why It Shows Up
WordPress loads many plugins in the same PHP runtime. Plugin Check found a global symbol or hook name that is not clearly namespaced to this plugin.
Why It Matters
Unprefixed globals can collide with WordPress core, themes, or other plugins, causing fatal errors, overwritten values, or handlers running in the wrong context.
How to Fix
- Choose a short, unique prefix or namespace based on the plugin slug or vendor name.
- Rename the global variable so it cannot collide with code from another plugin.
- For public hooks, document the final hook name and keep it stable after release.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #2151 | Friendly Captcha for WordPress | 35 | 192 | 62 | 9k+ | Output is not escaped | ||
| #2152 | FrontBlocks for Gutenberg/GeneratePress | 35 | 10 | 7 | 500 | Offloaded Content | ||
| #2153 | Frontend Reset Password | 35 | 83 | 128 | 10k+ | Text Domain Mismatch | ||
| #2154 | GA4WP – Analytics Dashboard for the Website | 35 | 434 | 157 | 2k+ | Text Domain Mismatch | ||
| #2155 | Video Gallery – YouTube Gallery, Vimeo, Video Portfolio, Image Portfolio and Image Gallery | 35 | 50 | 199 | 10k+ | Non-prefixed global variable | ||
| #2156 | Genesis Simple Sidebars | 35 | 9 | 51 | 10k+ | Nonce verification recommended | ||
| #2157 | GeoTargeting Lite – WordPress Geolocation | 35 | 66 | 79 | 1k+ | Output is not escaped | ||
| #2158 | Get a Newsletter | 35 | 138 | 144 | 400 | Output is not escaped | ||
| #2159 | Glossary | 35 | 169 | 93 | 2k+ | Non Singular String Literal Domain | ||
| #2160 | Gravitec.net – Web Push Notifications | 35 | 47 | 52 | 1k+ | wp function not compatible with requires wp | ||
| #2161 | Gum Addon for Elementor | 35 | 660 | 72 | 50k+ | Text Domain Mismatch | ||
| #2162 | Gumlet – Image optimization with Resize, Compression, Lazy load, Caching & CDN delivery | 35 | 53 | 45 | 500 | parse url parse url | ||
| #2163 | Health Check & Troubleshooting | 35 | 264 | 238 | 300k+ | Missing Arg Domain | ||
| #2164 | Heartbeat Control | 35 | 27 | 18 | 80k+ | Missing Arg Domain | ||
| #2165 | Social Comments by Heateor | 35 | 285 | 35 | 700 | Unsafe printing function | ||
| #2166 | Highlighting Code Block | 35 | 6 | 2 | 10k+ | Hidden files included | ||
| #2167 | Hippoo Mobile App for WooCommerce | 35 | 5 | 92 | 1k+ | Direct Query | ||
| #2168 | HivePress – Business Directory, Listings & Classified Ads Plugin | 35 | 38 | 180 | 10k+ | Direct Query | ||
| #2169 | Hyve Lite – AI Chatbot, ChatGPT-Powered Conversational Support | 35 | 1 | 40 | 7k+ | Direct Query | ||
| #2170 | Iframely – WP media embeds, cards and blocks | 35 | 136 | 43 | 2k+ | Unsafe printing function | ||
| #2171 | Image Slider | 35 | 192 | 95 | 4k+ | Output is not escaped | ||
| #2172 | Image Widget | 35 | 165 | 31 | 100k+ | Output is not escaped | ||
| #2173 | Import Users & Customers with Meta | WP Ultimate CSV Importer Add-on | 35 | 27 | 140 | 5k+ | Interpolated SQL is not prepared | ||
| #2174 | Imsanity | 35 | 32 | 29 | 200k+ | Direct Query | ||
| #2175 | IndieWeb | 35 | 5 | 9 | 600 | Non-prefixed hook name | ||
| #2176 | InPost PL | 35 | 2 | 938 | 10k+ | Non-prefixed global variable | ||
| #2177 | Woody Code Snippets – Insert PHP, CSS, JS, and Header/Footer Scripts | 35 | 64 | 91 | 60k+ | Output is not escaped | ||
| #2178 | Inspiro Starter Sites – 20+ Free Demo Templates for Gutenberg & Elementor | 35 | 6 | 200 | 10k+ | Non-prefixed global variable | ||
| #2179 | Social Feed Gallery | 35 | 104 | 52 | 80k+ | Text Domain Mismatch | ||
| #2180 | Instant CSS | 35 | 25 | 25 | 3k+ | Output is not escaped | ||
| #2181 | Instapage Plugin | 35 | 220 | 45 | 4k+ | Output is not escaped | ||
| #2182 | ICIT Weather Widget | 35 | 358 | 8 | 400 | Output is not escaped | ||
| #2183 | IP Based Login | 35 | 179 | 146 | 600 | Output is not escaped | ||
| #2184 | iPages – FlipBook Image & PDF Viewer | 35 | 467 | 177 | 2k+ | Text Domain Mismatch | ||
| #2185 | Japanese font for WordPress(Previously: Japanese Font for TinyMCE) | 35 | 11 | 37 | 10k+ | Non-prefixed global variable | ||
| #2186 | Static Site Exporter | 35 | 54 | 25 | 500 | file system operations mkdir | ||
| #2187 | Jetpack VideoPress | 35 | 710 | 241 | 7k+ | Text Domain Mismatch | ||
| #2188 | JSON Feed (jsonfeed.org) | 35 | 9 | 29 | 1k+ | Non-prefixed global variable | ||
| #2189 | Nobs • Share Buttons | 35 | 314 | 85 | 3k+ | Output is not escaped | ||
| #2190 | Kargo Takip | 35 | 84 | 142 | 3k+ | Missing nonce verification | ||
| #2191 | Kaya QR Code Generator | 35 | 193 | 40 | 20k+ | Non Singular String Literal Domain | ||
| #2192 | KBoard 위젯 – 워드프레스 게시판 | 35 | 53 | 32 | 3k+ | Output is not escaped | ||
| #2193 | Kustom Checkout for WooCommerce | 35 | 101 | 505 | 10k+ | Dynamic hook name | ||
| #2194 | Flexible Invoices for WooCommerce – KSeF Add-on | 35 | 39 | 15 | 600 | Non-prefixed global variable | ||
| #2195 | Lead Call Buttons | 35 | 113 | 81 | 5k+ | Output is not escaped | ||
| #2196 | Lead Generation Form | 35 | 21 | 63 | 600 | Non-prefixed global variable | ||
| #2197 | Topic Progression Using Storyline/Captivate for LearnDash | 35 | 382 | 25 | 400 | Text Domain Mismatch | ||
| #2198 | LiteSpeed Cache | 35 | 286 | 893 | 7m+ | Non-prefixed global variable | ||
| #2199 | Log in with Google | 35 | 5 | 17 | 6k+ | Non-prefixed global variable | ||
| #2200 | Magic Login – Passwordless Authentication for WordPress – Login Without Password | 35 | 23 | 53 | 3k+ | Missing nonce verification |
