WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound
Non-prefixed global variable
The plugin defines a global variable without a plugin-specific prefix.
Why It Shows Up
WordPress loads many plugins in the same PHP runtime. Plugin Check found a global symbol or hook name that is not clearly namespaced to this plugin.
Why It Matters
Unprefixed globals can collide with WordPress core, themes, or other plugins, causing fatal errors, overwritten values, or handlers running in the wrong context.
How to Fix
- Choose a short, unique prefix or namespace based on the plugin slug or vendor name.
- Rename the global variable so it cannot collide with code from another plugin.
- For public hooks, document the final hook name and keep it stable after release.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #3601 | Accordions | 55 | 1 | 101 | 20k+ | slow db query meta query | ||
| #3602 | Admin Bar User Switching | 55 | 16 | 31 | 2k+ | Input is not validated | ||
| #3603 | Advanced Custom Order Status for WooCommerce | 55 | 44 | 33 | 500 | Text Domain Mismatch | ||
| #3604 | AI Assistant for Elementor – Auto Content Writer, OpenAI, ChatGPT | 55 | 151 | 24 | 400 | Text Domain Mismatch | ||
| #3605 | Auto Image Alt Attribute | 55 | 26 | 7 | 6k+ | Unsafe printing function | ||
| #3606 | Email Template Customizer for WooCommerce | 55 | 552 | 248 | 20k+ | Text Domain Mismatch | ||
| #3607 | Gutenify – Visual Site Builder Blocks & Site Templates | 55 | 66 | 40 | 5k+ | Missing Arg Domain | ||
| #3608 | Head, Footer and Post Injections | 55 | 9 | 52 | 300k+ | Non-prefixed global variable | ||
| #3609 | Holded integration | 55 | 72 | 23 | 2k+ | Non Singular String Literal Domain | ||
| #3610 | Insert Pages | 55 | 52 | 30 | 40k+ | Output is not escaped | ||
| #3611 | JetWidgets For Elementor | 55 | 99 | 279 | 10k+ | Non-prefixed global variable | ||
| #3612 | Landingi Landing Pages | 55 | 18 | 23 | 2k+ | Input is not sanitized | ||
| #3613 | LifterLMS Labs | 55 | 51 | 8 | 2k+ | Output is not escaped | ||
| #3614 | LoginPress | wp-login Custom Login Page Customizer | 55 | 124 | 301 | 200k+ | Non-prefixed function | ||
| #3615 | Mailster for WooCommerce | 55 | 23 | 32 | 1k+ | Non-prefixed global variable | ||
| #3616 | Marvy – Background Animations for Elementor | 55 | 63 | 34 | 4k+ | Text Domain Mismatch | ||
| #3617 | Page Animations And Transitions | 55 | 89 | 67 | 1k+ | Non Singular String Literal Domain | ||
| #3618 | Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder | 55 | 54 | 692 | 700k+ | Non-prefixed hook name | ||
| #3619 | Popup Maker – Responsive popup, Exit Intent Pop up, Email Optins, Autoresponder & More | 55 | 44 | 64 | 7k+ | Text Domain Mismatch | ||
| #3620 | Refer A Friend for WooCommerce by WPGens | 55 | 77 | 21 | 1k+ | Text Domain Mismatch | ||
| #3621 | Semrush Content Toolkit | 55 | 22 | 24 | 2k+ | Non-prefixed global variable | ||
| #3622 | Slider & Carousel Block by Sliderberg | 55 | 23 | 18 | 1k+ | Output is not escaped | ||
| #3623 | Text Changer for Welcart | 55 | 477 | 43 | 500 | Text Domain Mismatch | ||
| #3624 | Themeflection Numbers – Number Counter and Animated Numbers | 55 | 224 | 73 | 3k+ | Text Domain Mismatch | ||
| #3625 | VS Contact Form | 55 | 3 | 318 | 7k+ | Non-prefixed global variable | ||
| #3626 | VK Block Patterns | 55 | 8 | 61 | 100k+ | Non-prefixed function | ||
| #3627 | AAArdvark Accessibility Reports | 55 | 62 | 42 | 600 | Non-prefixed global variable | ||
| #3628 | WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System | 55 | 22 | 35 | 5k+ | Output is not escaped | ||
| #3629 | WP Ultimate Review | 55 | 23 | 381 | 70k+ | Non-prefixed global variable | ||
| #3630 | WPC Smart Messages for WooCommerce | 55 | 6 | 84 | 1k+ | Non-prefixed global variable | ||
| #3631 | Advanced Floating Content Lite | 56 | 88 | 49 | 7k+ | Text Domain Mismatch | ||
| #3632 | AI Copilot – ChatGPT Chatbot & AI Engine for Post Automation | 56 | 65 | 20 | 1k+ | Text Domain Mismatch | ||
| #3633 | Anti-Captcha (anti-spam botblocker) | 56 | 23 | 26 | 1k+ | rand mt rand | ||
| #3634 | BuddyCommerce: WooCommerce and BuddyPress Integration | 56 | 29 | 19 | 800 | Output is not escaped | ||
| #3635 | SMTP by BestWebSoft | 56 | 486 | 175 | 1k+ | Text Domain Mismatch | ||
| #3636 | Contextual Adminbar Color | 56 | 18 | 16 | 500 | Output is not escaped | ||
| #3637 | FluentSnippets – High-Performance Code Snippets, Header & Footer Code, Custom CSS & PHP Code Manager | 56 | 31 | 27 | 50k+ | Nonce verification recommended | ||
| #3638 | Fluent Connect – Connect ThriveCart with your WordPress and FluentCRM | 56 | 37 | 54 | 600 | curl curl setopt | ||
| #3639 | Grids: Layout builder for WordPress | 56 | 24 | 27 | 2k+ | Missing direct file access protection | ||
| #3640 | Jquery Validation For Contact Form 7 | 56 | 18 | 19 | 9k+ | Missing direct file access protection | ||
| #3641 | Form data to kintone | 56 | 25 | 22 | 1k+ | Output is not escaped | ||
| #3642 | LearnPress – Course Wishlist | 56 | 35 | 22 | 20k+ | Output is not escaped | ||
| #3643 | Maya Business Plugin | 56 | 9 | 39 | 600 | Input is not validated | ||
| #3644 | Replace Protected Password | 56 | 6 | 18 | 600 | Input is not sanitized | ||
| #3645 | Review Stream | 56 | 41 | 42 | 400 | Non-prefixed global variable | ||
| #3646 | Image Optimization For SEO | 56 | 116 | 69 | 3k+ | Non Singular String Literal Domain | ||
| #3647 | Subscription & Recurring Payment for WooCommerce | 56 | 8 | 485 | 800 | Non-prefixed global variable | ||
| #3648 | SureMembers – Membership & Content Restriction Plugin | 56 | 52 | 102 | 900 | Request data is not unslashed | ||
| #3649 | TextBuilder | 56 | 20 | 34 | 4k+ | Missing Arg Domain | ||
| #3650 | ThemeinWP Import Companion | 56 | 17 | 14 | 4k+ | Unsafe printing function |
