WordPress.PHP.DevelopmentFunctions.error_log_error_log
error log error log
Development or debugging behavior appears in code that may run in production.
Why It Shows Up
The scan found logging, debugging, path disclosure, `phpinfo()`, error-reporting changes, or similar development-oriented functions.
Why It Matters
Debug output can leak paths, configuration, request data, stack details, or sensitive runtime information.
How to Fix
- Remove temporary debugging calls before release.
- If logging is required, guard it with `WP_DEBUG` or a plugin setting intended for administrators.
- Never show debug details to unauthenticated visitors or normal front-end users.
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #1001 | WP Discord Post Plus – Supports Unlimited Channels | 38 | 116 | 34 | 700 | Text Domain Mismatch | ||
| #1002 | WPC Product Options for WooCommerce | 38 | 57 | 182 | 4k+ | Non-prefixed global variable | ||
| #1003 | WPTurbo -WordPress性能优化插件 | 38 | 20 | 34 | 600 | Output is not escaped | ||
| #1004 | ZeroBounce Email Verification & Validation | 38 | 299 | 162 | 1k+ | Text Domain Mismatch | ||
| #1005 | Accessibility by AllAccessible | 39 | 200 | 82 | 2k+ | Unsafe printing function | ||
| #1006 | Andreani WooCommerce | 39 | 21 | 86 | 800 | Non-prefixed global variable | ||
| #1007 | AWEOS WP Lock | 39 | 24 | 53 | 400 | Output is not escaped | ||
| #1008 | Blackhole for Bad Bots | 39 | 123 | 69 | 30k+ | Output is not escaped | ||
| #1009 | BugSnag Error Monitoring plugin | 39 | 52 | 96 | 2k+ | wp function not compatible with requires wp | ||
| #1010 | Bulk Auto Image Alt Text (Alt tag, Alt attribute) optimizer (image SEO) | 39 | 16 | 47 | 10k+ | Request data is not unslashed | ||
| #1011 | CatFolders Document Gallery & PDF Library | 39 | 66 | 32 | 3k+ | Output is not escaped | ||
| #1012 | Contact Form 7 extension for Google Map fields | 39 | 118 | 58 | 500 | Missing Arg Domain | ||
| #1013 | Contact Form 7 – Dynamic Text Extension | 39 | 103 | 28 | 100k+ | Output is not escaped | ||
| #1014 | Datalogics Ecommerce Delivery – Datalogics | 39 | 13 | 115 | 500 | Nonce verification recommended | ||
| #1015 | Deliverability – pass DKIM, SPF, DMARC & more | 39 | 21 | 71 | 800 | Nonce verification recommended | ||
| #1016 | Flex Import | 39 | 15 | 140 | 500 | Non-prefixed global variable | ||
| #1017 | Gutenverse News – News Blocks for Blog & Magazine Sites | 39 | 37 | 65 | 800 | Non-prefixed hook name | ||
| #1018 | If Menu – Visibility control for Menus | 39 | 281 | 63 | 50k+ | Output is not escaped | ||
| #1019 | Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid | 39 | 65 | 72 | 6k+ | block api version too low | ||
| #1020 | Kikote – Location Picker at Checkout & Google Address AutoFill Plugin for WooCommerce | 39 | 76 | 64 | 1k+ | Missing Translators Comment | ||
| #1021 | Markup by Attribute for WooCommerce | 39 | 46 | 102 | 2k+ | Direct Query | ||
| #1022 | Multilingual Contact Form 7 with Polylang | 39 | 50 | 30 | 9k+ | Text Domain Mismatch | ||
| #1023 | Paystack Add-On for Gravity Forms | 39 | 96 | 31 | 400 | Text Domain Mismatch | ||
| #1024 | Purge Varnish Cache | 39 | 113 | 151 | 1k+ | Non-prefixed global variable | ||
| #1025 | Redirect 404 Error Page to Homepage or Custom Page with Logs | 39 | 27 | 53 | 10k+ | Nonce verification recommended | ||
| #1026 | Shipping by Rules for WooCommerce | 39 | 130 | 48 | 500 | Output is not escaped | ||
| #1027 | Shipping Simulator for WooCommerce | 39 | 120 | 39 | 5k+ | Text Domain Mismatch | ||
| #1028 | Simpaisa Wallet (Jazzcash & Easypaisa) Payment Services | 39 | 67 | 74 | 1k+ | Interpolated Variable Text | ||
| #1029 | Slider Text Scroll | 39 | 95 | 52 | 400 | Text Domain Mismatch | ||
| #1030 | Spreadr Woocommerce Plugin – Amazon Importer for Dropshipping and Affiliate | 39 | 42 | 226 | 500 | Request data is not unslashed | ||
| #1031 | Stock Ticker | 39 | 92 | 49 | 2k+ | Output is not escaped | ||
| #1032 | Traffic Monitor | 39 | 6 | 143 | 1k+ | Direct Query | ||
| #1033 | BeGateway Payment Gateway for WooCommerce | 39 | 57 | 44 | 400 | Unsafe printing function | ||
| #1034 | Payment Gateway – nexi Alpha Bank for WooCommerce | 39 | 96 | 40 | 1k+ | Non Singular String Literal Domain | ||
| #1035 | WP Limit Login Attempts | 39 | 26 | 67 | 10k+ | Direct Query | ||
| #1036 | Advanced Country Blocker | 40 | 23 | 77 | 2k+ | Exception output is not escaped | ||
| #1037 | Atomic Edge Security – Firewall, Malware Scan and Login Security | 40 | 12 | 184 | 700 | Non-prefixed global variable | ||
| #1038 | CC BMI Calculator | 40 | 135 | 7 | 800 | Output is not escaped | ||
| #1039 | codoc | 40 | 19 | 39 | 2k+ | Request data is not unslashed | ||
| #1040 | Contact Form 7 GetResponse Extension | 40 | 88 | 18 | 1k+ | Text Domain Mismatch | ||
| #1041 | Cron Logger | 40 | 49 | 36 | 1k+ | Output is not escaped | ||
| #1042 | Dashify: WooCommerce admin dashboard theme | 40 | 16 | 131 | 900 | Nonce verification recommended | ||
| #1043 | FlyWP Helper – Page Cache, Page Optimization, Emails for FlyWP Server Control Panel | 40 | 20 | 81 | 4k+ | Non-prefixed global variable | ||
| #1044 | JSM Show Order Metadata for WooCommerce HPOS | 40 | 17 | 64 | 700 | Nonce verification recommended | ||
| #1045 | JSM Show Post Metadata | 40 | 15 | 66 | 10k+ | Nonce verification recommended | ||
| #1046 | JSM Show Term Metadata | 40 | 14 | 64 | 900 | Nonce verification recommended | ||
| #1047 | JSM Show User Metadata | 40 | 14 | 64 | 3k+ | Nonce verification recommended | ||
| #1048 | MailerSend – Official SMTP Integration | 40 | 39 | 25 | 2k+ | Unsafe printing function | ||
| #1049 | My Social Feeds – Social Feeds Embedder Plugin for WP | 40 | 8 | 77 | 400 | Request data is not unslashed | ||
| #1050 | One Click SSL | 40 | 136 | 62 | 10k+ | Unsafe printing function |
