WordPress.PHP.DevelopmentFunctions.error_log_error_log
error log error log
Development or debugging behavior appears in code that may run in production.
Why It Shows Up
The scan found logging, debugging, path disclosure, `phpinfo()`, error-reporting changes, or similar development-oriented functions.
Why It Matters
Debug output can leak paths, configuration, request data, stack details, or sensitive runtime information.
How to Fix
- Remove temporary debugging calls before release.
- If logging is required, guard it with `WP_DEBUG` or a plugin setting intended for administrators.
- Never show debug details to unauthenticated visitors or normal front-end users.
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #901 | Yotpo: Product & Photo Reviews for WooCommerce | 35 | 24 | 189 | 2k+ | Non-prefixed function | ||
| #902 | authLdap | 36 | 47 | 30 | 4k+ | Exception output is not escaped | ||
| #903 | Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder | 36 | 3 | 321 | 10k+ | Nonce verification recommended | ||
| #904 | BuddyMeet | 36 | 114 | 32 | 700 | Unsafe printing function | ||
| #905 | Contact Form 7 Polylang Module | 36 | 32 | 45 | 5k+ | Output is not escaped | ||
| #906 | Code Snippets | 36 | 34 | 203 | 1m+ | Nonce verification recommended | ||
| #907 | ColorMeShop WordPress Plugin | 36 | 392 | 37 | 600 | Exception output is not escaped | ||
| #908 | Conditional Payments for WooCommerce | 36 | 292 | 184 | 10k+ | Text Domain Mismatch | ||
| #909 | Conditional Shipping for WooCommerce | 36 | 93 | 196 | 10k+ | Non-prefixed global variable | ||
| #910 | Depicter — Popup & Slider Builder | 36 | 130 | 121 | 80k+ | Exception output is not escaped | ||
| #911 | Duitku Payment Gateway | 36 | 507 | 107 | 700 | Text Domain Mismatch | ||
| #912 | Duplicate Post – duplicate pages, copy content, clone posts | 36 | 71 | 81 | 5k+ | wp function not compatible with requires wp | ||
| #913 | Happy WooCommerce FAQs – Ultimate Product FAQ Plugin | 36 | 65 | 119 | 1k+ | Nonce verification recommended | ||
| #914 | GetPaid > Wallet | 36 | 149 | 174 | 700 | Text Domain Mismatch | ||
| #915 | HTML Forms – Simple WordPress Forms Plugin | 36 | 231 | 166 | 10k+ | Output is not escaped | ||
| #916 | If-So Geolocation | 36 | 50 | 57 | 1k+ | Non-prefixed global variable | ||
| #917 | Image Watermark | 36 | 76 | 179 | 40k+ | Missing nonce verification | ||
| #918 | Libro de Reclamaciones y Quejas | 36 | 266 | 124 | 4k+ | Text Domain Mismatch | ||
| #919 | Login as User | 36 | 101 | 64 | 30k+ | Output is not escaped | ||
| #920 | Order Status History for WooCommerce | 36 | 210 | 171 | 1k+ | Output is not escaped | ||
| #921 | PayTR Sanal POS WooCommerce – iFrame API | 36 | 117 | 54 | 10k+ | Output is not escaped | ||
| #922 | WowStore – Store Builder & Product Blocks for WooCommerce | 36 | 66 | 429 | 4k+ | Non-prefixed global variable | ||
| #923 | افزونه رسمی ترب | 36 | 42 | 86 | 20k+ | Exception output is not escaped | ||
| #924 | Better Find and Replace – AI-Powered Suggestions | 36 | 67 | 129 | 40k+ | Missing direct file access protection | ||
| #925 | Speed Optimizer – The All-In-One Performance-Boosting Plugin | 36 | 45 | 96 | 1m+ | Non-prefixed hook name | ||
| #926 | Stripe Tax – Sales tax automation for WooCommerce | 36 | 97 | 61 | 30k+ | Exception output is not escaped | ||
| #927 | Sync QCloud COS | 36 | 63 | 109 | 600 | Non-prefixed function | ||
| #928 | Zoho ZeptoMail | 36 | 32 | 110 | 5k+ | Request data is not unslashed | ||
| #929 | Shipping with Venipak for WooCommerce | 36 | 239 | 61 | 1k+ | Text Domain Mismatch | ||
| #930 | Rabo Smart Pay for WooCommerce | 36 | 147 | 54 | 600 | Text Domain Mismatch | ||
| #931 | Extended Coupon Features for WooCommerce FREE | 36 | 219 | 63 | 10k+ | Text Domain Mismatch | ||
| #932 | SuperFaktura WooCommerce | 36 | 60 | 115 | 2k+ | Nonce verification recommended | ||
| #933 | WP Coder – Insert & Manage Code Snippets | 36 | 53 | 280 | 10k+ | Nonce verification recommended | ||
| #934 | WP Hotel Booking WooCommerce | 36 | 93 | 99 | 1k+ | Output is not escaped | ||
| #935 | WP Show Posts | 36 | 107 | 102 | 70k+ | Output is not escaped | ||
| #936 | WPAvatar | 36 | 425 | 45 | 700 | Unsafe printing function | ||
| #937 | WP fail2ban Blocklist | 36 | 61 | 63 | 3k+ | SQL query is not prepared | ||
| #938 | Advanced Custom Fields: NextGEN Gallery Field add-on | 37 | 131 | 20 | 400 | Output is not escaped | ||
| #939 | Advanced Media Offloader | 37 | 59 | 93 | 5k+ | error log error log | ||
| #940 | Banhammer – Monitor Site Traffic, Block Bad Users and Bots | 37 | 104 | 174 | 1k+ | Output is not escaped | ||
| #941 | Custom Thank You Page Customize For WooCommerce by Binary Carpenter | 37 | 45 | 80 | 2k+ | error log error log | ||
| #942 | Better Click To Share – Shareable Quote Boxes for X (Twitter) | 37 | 170 | 59 | 6k+ | Unsafe printing function | ||
| #943 | ClickRank – Ai SEO Automation | 37 | 10 | 226 | 1k+ | Direct Query | ||
| #944 | CookieAdmin – Cookie Consent Banner | 37 | 43 | 86 | 400k+ | Nonce verification recommended | ||
| #945 | Ultimate Custom Add To Cart Button (Ajax) For WooCommerce by Binary Carpenter | 37 | 151 | 61 | 700 | Output is not escaped | ||
| #946 | Debug Log Viewer | 37 | 26 | 83 | 1k+ | Missing nonce verification | ||
| #947 | Duo Two-Factor Authentication | 37 | 44 | 61 | 3k+ | Missing nonce verification | ||
| #948 | Easy Testimonial Slider and Form | 37 | 14 | 144 | 700 | Request data is not unslashed | ||
| #949 | EasyMe Connect | 37 | 130 | 45 | 500 | Text Domain Mismatch | ||
| #950 | Email Encoder – Protect Email Addresses and Phone Numbers | 37 | 10 | 150 | 90k+ | Non-prefixed global variable |
