WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound
Non-prefixed global variable
The plugin defines a global variable without a plugin-specific prefix.
Why It Shows Up
WordPress loads many plugins in the same PHP runtime. Plugin Check found a global symbol or hook name that is not clearly namespaced to this plugin.
Why It Matters
Unprefixed globals can collide with WordPress core, themes, or other plugins, causing fatal errors, overwritten values, or handlers running in the wrong context.
How to Fix
- Choose a short, unique prefix or namespace based on the plugin slug or vendor name.
- Rename the global variable so it cannot collide with code from another plugin.
- For public hooks, document the final hook name and keep it stable after release.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #2601 | CorvusPay WooCommerce Payment Gateway | 37 | 29 | 141 | 1k+ | Missing nonce verification | ||
| #2602 | Ultimate Custom Add To Cart Button (Ajax) For WooCommerce by Binary Carpenter | 37 | 151 | 61 | 600 | Output is not escaped | ||
| #2603 | Custom Post Template | 37 | 48 | 30 | 10k+ | Output is not escaped | ||
| #2604 | Debug Log Viewer | 37 | 26 | 83 | 1k+ | Missing nonce verification | ||
| #2605 | Disclaimer Popup | 37 | 313 | 53 | 1k+ | Text Domain Mismatch | ||
| #2606 | Donation Block For PayPal | 37 | 23 | 106 | 600 | Input is not validated | ||
| #2607 | Pricing Table WordPress Plugin – Easy Pricing Tables | 37 | 332 | 161 | 10k+ | Output is not escaped | ||
| #2608 | EasyMe Connect | 37 | 130 | 45 | 500 | Text Domain Mismatch | ||
| #2609 | Encyclopedia / Glossary / Wiki | 37 | 263 | 48 | 1k+ | Output is not escaped | ||
| #2610 | Excerpt Editor | 37 | 170 | 142 | 500 | Unsafe printing function | ||
| #2611 | Exploit Scanner | 37 | 25 | 130 | 8k+ | Non-prefixed global variable | ||
| #2612 | Furgonetka.pl: Przesyłki & Narzędzia e-commerce | 37 | 66 | 48 | 7k+ | Exception output is not escaped | ||
| #2613 | Get Custom Field Values | 37 | 40 | 44 | 1k+ | Output is not escaped | ||
| #2614 | Gmail SMTP | 37 | 85 | 71 | 10k+ | Unsafe printing function | ||
| #2615 | GoCache | 37 | 273 | 43 | 900 | Non Singular String Literal Domain | ||
| #2616 | Google for WooCommerce | 37 | 328 | 121 | 800k+ | Exception output is not escaped | ||
| #2617 | GoPay for WooCommerce | 37 | 66 | 103 | 1k+ | Non-prefixed global variable | ||
| #2618 | GS Portfolio for Envato | 37 | 155 | 75 | 4k+ | Text Domain Mismatch | ||
| #2619 | Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder | 37 | 83 | 113 | 20k+ | SQL query is not prepared | ||
| #2620 | HandL UTM Grabber / Tracker | 37 | 31 | 146 | 10k+ | Missing nonce verification | ||
| #2621 | Horizontal scrolling announcements | 37 | 215 | 140 | 8k+ | Output is not escaped | ||
| #2622 | HT Builder – WordPress Theme Builder for Elementor | 37 | 142 | 41 | 1k+ | Output is not escaped | ||
| #2623 | HT Menu – WordPress Mega Menu Builder for Elementor | 37 | 302 | 58 | 3k+ | Text Domain Mismatch | ||
| #2624 | .htaccess Site Access Control | 37 | 54 | 67 | 800 | Input is not sanitized | ||
| #2625 | Image Optimizer by 10web – Image Optimizer and Compression plugin | 37 | 244 | 45 | 3k+ | Text Domain Mismatch | ||
| #2626 | Images Optimize and Upload CF7 | 37 | 130 | 36 | 600 | Non Singular String Literal Domain | ||
| #2627 | Images to WebP | 37 | 39 | 50 | 9k+ | curl curl setopt | ||
| #2628 | Job Manager & Career – Manage job board listings, and recruitments | 37 | 112 | 205 | 2k+ | Missing nonce verification | ||
| #2629 | JS Help Desk – AI-Powered Support & Ticketing System | 37 | 17 | 406 | 7k+ | Missing nonce verification | ||
| #2630 | Language Switcher | 37 | 81 | 105 | 1k+ | Missing Translators Comment | ||
| #2631 | LearnPress – Course Review | 37 | 67 | 43 | 20k+ | Output is not escaped | ||
| #2632 | LH Archived Post Status | 37 | 150 | 64 | 3k+ | Text Domain Mismatch | ||
| #2633 | PiWeb Live sales notification for WooCommerce | 37 | 289 | 77 | 30k+ | Text Domain Mismatch | ||
| #2634 | LiveJournal Importer | 37 | 86 | 67 | 8k+ | Output is not escaped | ||
| #2635 | Local Time Clock | 37 | 105 | 11 | 1k+ | Output is not escaped | ||
| #2636 | Localendar Calendar for WordPress | 37 | 241 | 6 | 400 | Output is not escaped | ||
| #2637 | MailingBoss WP Plugin | 37 | 108 | 30 | 600 | Output is not escaped | ||
| #2638 | Media Sweep – WordPress Media Cleaner | 37 | 56 | 137 | 1k+ | Interpolated SQL is not prepared | ||
| #2639 | Max Mega Menu | 37 | 249 | 174 | 300k+ | Output is not escaped | ||
| #2640 | Meks Video Importer | 37 | 62 | 239 | 2k+ | Input is not sanitized | ||
| #2641 | CrawlWP SEO – Instant Search Engine Indexing & SEO Performance Monitor | 37 | 47 | 90 | 40k+ | Dynamic hook name | ||
| #2642 | NextGEN Scroll Gallery | 37 | 33 | 28 | 1k+ | Output is not escaped | ||
| #2643 | Ninja Van (MY) | 37 | 21 | 258 | 1k+ | Non-prefixed global variable | ||
| #2644 | Sendle Shipping Plugin | 37 | 91 | 64 | 800 | wp function not compatible with requires wp | ||
| #2645 | Oliver POS – WooCommerce POS for iPhone, iPad & Android | 37 | 15 | 242 | 800 | Interpolated SQL is not prepared | ||
| #2646 | Optin Forms – Simple List Building Plugin for WordPress | 37 | 647 | 22 | 3k+ | Output is not escaped | ||
| #2647 | WP All Export – Order Export for WooCommerce | 37 | 109 | 111 | 3k+ | Text Domain Mismatch | ||
| #2648 | Page scroll to id | 37 | 38 | 120 | 100k+ | Missing nonce verification | ||
| #2649 | Panda Pods Repeater Field | 37 | 9 | 260 | 600 | Non-prefixed global variable | ||
| #2650 | PayU CommercePro Plugin | 37 | 218 | 7k+ | error log error log |
