WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound
Non-prefixed global variable
The plugin defines a global variable without a plugin-specific prefix.
Why It Shows Up
WordPress loads many plugins in the same PHP runtime. Plugin Check found a global symbol or hook name that is not clearly namespaced to this plugin.
Why It Matters
Unprefixed globals can collide with WordPress core, themes, or other plugins, causing fatal errors, overwritten values, or handlers running in the wrong context.
How to Fix
- Choose a short, unique prefix or namespace based on the plugin slug or vendor name.
- Rename the global variable so it cannot collide with code from another plugin.
- For public hooks, document the final hook name and keep it stable after release.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #3251 | Simple Accessibility Button | 41 | 33 | 171 | 900 | Non-prefixed global variable | ||
| #3252 | Pricing Table – Responsive & Easy | 42 | 117 | 148 | 3k+ | Non-prefixed global variable | ||
| #3253 | ActiveTrail – Contact Form 7 | 42 | 18 | 85 | 600 | Missing nonce verification | ||
| #3254 | Add to Home Screen & Progressive Web App | 42 | 23 | 68 | 1k+ | Request data is not unslashed | ||
| #3255 | Admin Options Pages | 42 | 3 | 284 | 500 | Nonce verification recommended | ||
| #3256 | Post Grid Master — Post Grids & AJAX Filters | 42 | 44 | 115 | 1k+ | Non-prefixed global variable | ||
| #3257 | Bazz CallBack widget | 42 | 51 | 22 | 3k+ | Unsafe printing function | ||
| #3258 | HTML Template for CF7 | 42 | 21 | 27 | 1k+ | Non-prefixed global variable | ||
| #3259 | Contact Form 7 add confirm | 42 | 31 | 51 | 50k+ | Text Domain Mismatch | ||
| #3260 | Cronjob Scheduler | 42 | 20 | 36 | 1k+ | Input is not sanitized | ||
| #3261 | Custom Admin Page by BestWebSoft – Configurable WordPress Dashboard Pages Plugin | 42 | 472 | 181 | 400 | Text Domain Mismatch | ||
| #3262 | Custom Fields for Gutenberg | 42 | 24 | 24 | 1k+ | Output is not escaped | ||
| #3263 | Custom Login | 42 | 36 | 116 | 10k+ | Non-prefixed global variable | ||
| #3264 | Simpliest Social Share | 42 | 37 | 22 | 600 | Unsafe printing function | ||
| #3265 | Delete Expired Transients | 42 | 49 | 65 | 5k+ | Direct Query | ||
| #3266 | Disable Comments | 42 | 44 | 19 | 100k+ | Unsafe printing function | ||
| #3267 | Simple HTML Sitemap | 42 | 42 | 20 | 1k+ | Text Domain Mismatch | ||
| #3268 | Storefront Online Ordering by DoorDash | 42 | 76 | 10 | 600 | Output is not escaped | ||
| #3269 | Embedly | 42 | 17 | 38 | 2k+ | Output is not escaped | ||
| #3270 | FCM Push Notification from WP | 42 | 43 | 16 | 600 | Non Singular String Literal Domain | ||
| #3271 | File Media Renamer | 42 | 16 | 42 | 2k+ | Input is not sanitized | ||
| #3272 | Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution | 42 | 111 | 17 | 20k+ | Exception output is not escaped | ||
| #3273 | FormCraft – Form Builder | 42 | 186 | 156 | 2k+ | Text Domain Mismatch | ||
| #3274 | Gelato Integration for WooCommerce | 42 | 36 | 32 | 5k+ | Output is not escaped | ||
| #3275 | Geo Blocker – Control Site Access by Region and IP | 42 | 10 | 64 | 900 | Direct Query | ||
| #3276 | hCaptcha for WP | 42 | 115 | 18 | 70k+ | Exception output is not escaped | ||
| #3277 | LeadSnap | 42 | 14 | 84 | 1k+ | Input is not validated | ||
| #3278 | Mailster Cool Captcha | 42 | 65 | 28 | 400 | Text Domain Mismatch | ||
| #3279 | Nav Menu Collapse | 42 | 17 | 39 | 3k+ | Missing nonce verification | ||
| #3280 | OG Tags | 42 | 131 | 34 | 2k+ | Non Singular String Literal Domain | ||
| #3281 | OnPay.io for WooCommerce | 42 | 238 | 37 | 1k+ | Text Domain Mismatch | ||
| #3282 | Photo Galleria | 42 | 78 | 5 | 800 | Missing Arg Domain | ||
| #3283 | Prismatic | 42 | 61 | 29 | 2k+ | Output is not escaped | ||
| #3284 | Product Price History for WooCommerce | 42 | 101 | 800 | Nonce verification recommended | |||
| #3285 | WP Required Taxonomies – Categories and Tags Mandatory | 42 | 43 | 36 | 1k+ | Non-prefixed global variable | ||
| #3286 | SALERT – Fake Sales Notification WooCommerce | 42 | 41 | 67 | 8k+ | Non-prefixed global variable | ||
| #3287 | Secure Passkeys | 42 | 146 | 76 | 1k+ | Exception output is not escaped | ||
| #3288 | Sendcloud Shipping | 42 | 78 | 56 | 5k+ | Output is not escaped | ||
| #3289 | Set All First Images As Featured | 42 | 44 | 13 | 700 | Text Domain Mismatch | ||
| #3290 | Simple Googlebot Visit | 42 | 32 | 67 | 1k+ | Non Singular String Literal Domain | ||
| #3291 | Simple Meta Tags | 42 | 28 | 13 | 700 | Output is not escaped | ||
| #3292 | Simple Side Tab | 42 | 29 | 17 | 10k+ | Unsafe printing function | ||
| #3293 | Speed Contact Bar | 42 | 53 | 20 | 5k+ | Output is not escaped | ||
| #3294 | Squelch Tabs and Accordions Shortcodes | 42 | 57 | 51 | 1k+ | Unsafe printing function | ||
| #3295 | Sticky Add To Cart Bar For WooCommerce | 42 | 46 | 54 | 600 | Output is not escaped | ||
| #3296 | Combine Social Photos | Still BE | 42 | 33 | 281 | 700 | Non-prefixed global variable | ||
| #3297 | Ultimate Coming Soon Page, Maintenance Mode & Under Construction – Gutenberg Block Builder & Landing Page | 42 | 15 | 89 | 10k+ | Non-prefixed global variable | ||
| #3298 | UniConsent Cookie Consent CMP – Consent Manager | 42 | 128 | 17 | 1k+ | Unsafe printing function | ||
| #3299 | Usermaven | 42 | 36 | 77 | 1k+ | Request data is not unslashed | ||
| #3300 | Vast Demo Import | 42 | 180 | 113 | 600 | Text Domain Mismatch |
