WordPress.PHP.DevelopmentFunctions.error_log_error_log
error log error log
Development or debugging behavior appears in code that may run in production.
Why It Shows Up
The scan found logging, debugging, path disclosure, `phpinfo()`, error-reporting changes, or similar development-oriented functions.
Why It Matters
Debug output can leak paths, configuration, request data, stack details, or sensitive runtime information.
How to Fix
- Remove temporary debugging calls before release.
- If logging is required, guard it with `WP_DEBUG` or a plugin setting intended for administrators.
- Never show debug details to unauthenticated visitors or normal front-end users.
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #951 | GHL Gravity Bridge – Send Gravity Forms leads to GHL CRM | 37 | 59 | 269 | 600 | Direct Query | ||
| #952 | XML Sitemap Generator for Google | 37 | 43 | 79 | 1m+ | Input is not validated | ||
| #953 | Images to WebP | 37 | 39 | 50 | 9k+ | curl curl setopt | ||
| #954 | Job Manager & Career – Manage job board listings, and recruitments | 37 | 112 | 205 | 2k+ | Missing nonce verification | ||
| #955 | LearnPress – Course Review | 37 | 67 | 43 | 20k+ | Output is not escaped | ||
| #956 | LH Archived Post Status | 37 | 150 | 64 | 3k+ | Text Domain Mismatch | ||
| #957 | LiveAgent – Omnichannel Help Desk & Live Chat Software | 37 | 125 | 142 | 400 | Non Singular String Literal Domain | ||
| #958 | Media Sweep – WordPress Media Cleaner | 37 | 56 | 137 | 1k+ | Interpolated SQL is not prepared | ||
| #959 | Monobank WP Payment | 37 | 78 | 41 | 1k+ | Text Domain Mismatch | ||
| #960 | Ninja Van (MY) | 37 | 21 | 258 | 1k+ | Non-prefixed global variable | ||
| #961 | OSM – OpenStreetMap | 37 | 130 | 64 | 10k+ | Output is not escaped | ||
| #962 | PayU CommercePro Plugin | 37 | 218 | 7k+ | error log error log | |||
| #963 | Rich Table of Contents | 37 | 262 | 57 | 20k+ | Output is not escaped | ||
| #964 | Send PDF for Contact Form 7 | 37 | 22 | 308 | 9k+ | Non-prefixed global variable | ||
| #965 | Sensei LMS Certificates | 37 | 97 | 362 | 4k+ | Non-prefixed global variable | ||
| #966 | Piraeus Bank WooCommerce Payment Gateway | 37 | 146 | 104 | 3k+ | Non Singular String Literal Domain | ||
| #967 | Variation Swatches for WooCommerce | 37 | 92 | 103 | 10k+ | Output is not escaped | ||
| #968 | WooCommerce PayPal Payments | 37 | 194 | 110 | 800k+ | Exception output is not escaped | ||
| #969 | Quickpay for WooCommerce | 37 | 66 | 56 | 4k+ | Nonce verification recommended | ||
| #970 | Wordable – Export Google Docs to WordPress | 37 | 47 | 63 | 2k+ | Output is not escaped | ||
| #971 | WP Category Permalink | 37 | 75 | 31 | 2k+ | Output is not escaped | ||
| #972 | FundEngine – Donation and Crowdfunding Platform | 37 | 90 | 9 | 1k+ | Exception output is not escaped | ||
| #973 | Persistent Login | 37 | 338 | 108 | 6k+ | Unsafe printing function | ||
| #974 | WP VR – 360 Panorama and Virtual Tour Builder | 37 | 3 | 275 | 10k+ | Non-prefixed hook name | ||
| #975 | Add Customer for WooCommerce | 38 | 229 | 153 | 1k+ | Text Domain Mismatch | ||
| #976 | AWCA – The Great Analytics Insights for Your eStore | 38 | 238 | 143 | 2k+ | Output is not escaped | ||
| #977 | Advanced Media Offloader | 38 | 57 | 93 | 5k+ | error log error log | ||
| #978 | Anant Sites — Elementor & Gutenberg Readymade Template Library Free & Pro Templates | 38 | 20 | 156 | 1k+ | Non-prefixed global variable | ||
| #979 | Audio Story Images | 38 | 46 | 44 | 400 | Output is not escaped | ||
| #980 | CF7 to Webhook | 38 | 102 | 72 | 30k+ | Unsafe printing function | ||
| #981 | Crop-Thumbnails | 38 | 33 | 27 | 40k+ | Missing direct file access protection | ||
| #982 | PiWeb Product Enquiry or product catalog for WooCommerce | 38 | 255 | 145 | 1k+ | Text Domain Mismatch | ||
| #983 | Export User Data | 38 | 187 | 62 | 6k+ | Text Domain Mismatch | ||
| #984 | Goal Tracker – Custom Event Tracking for GA4 | 38 | 541 | 25 | 2k+ | Output is not escaped | ||
| #985 | Icegram Mailer – Reliable Email Deliverability, No-code SMTP Replacement & Email logs | 38 | 36 | 106 | 1k+ | Non-prefixed global variable | ||
| #986 | ThumbPress – Compress Images, Manage Thumbnails, Detect Image Issues, WebP/AVIF, Lazy Loading, Hotlinking & More | 38 | 21 | 88 | 30k+ | Direct Query | ||
| #987 | Jock On Air Now (JOAN) | 38 | 121 | 224 | 400 | Output is not escaped | ||
| #988 | Jupiter X Core | 38 | 71 | 767 | 70k+ | Non-prefixed global variable | ||
| #989 | Kali Forms — Contact Form & Drag-and-Drop Builder | 38 | 3 | 252 | 10k+ | Dynamic hook name | ||
| #990 | OneSignal – Web Push Notifications | 38 | 53 | 64 | 70k+ | Output is not escaped | ||
| #991 | PDF Catalog for WooCommerce | 38 | 30 | 46 | 1k+ | Nonce verification recommended | ||
| #992 | Like This | 38 | 60 | 17 | 1k+ | Output is not escaped | ||
| #993 | Schema App Structured Data | 38 | 35 | 86 | 7k+ | Nonce verification recommended | ||
| #994 | Shapely Companion | 38 | 49 | 39 | 10k+ | Output is not escaped | ||
| #995 | Logo Slider , Logo Carousel , Logo showcase , Client Logo | 38 | 72 | 22 | 1k+ | Output is not escaped | ||
| #996 | Templatiq | 38 | 31 | 94 | 900 | Non-prefixed hook name | ||
| #997 | Accessibility Tools & Alt Text Finder | 38 | 36 | 56 | 3k+ | Text Domain Mismatch | ||
| #998 | TRUENDO | GDPR Compliant Cookie Manager | 38 | 98 | 38 | 600 | Output is not escaped | ||
| #999 | W2S – Migrate WooCommerce to Shopify | 38 | 33 | 132 | 1k+ | Non-prefixed global variable | ||
| #1000 | Shipping Packages for WooCommerce – Dropship from multiple locations like AliExpress, eBay, Amazon, Etsy | 38 | 94 | 26 | 900 | Non Singular String Literal Domain |
