WordPress.PHP.DevelopmentFunctions.error_log_print_r
error log print r
Development or debugging behavior appears in code that may run in production.
Why It Shows Up
The scan found logging, debugging, path disclosure, `phpinfo()`, error-reporting changes, or similar development-oriented functions.
Why It Matters
Debug output can leak paths, configuration, request data, stack details, or sensitive runtime information.
How to Fix
- Remove temporary debugging calls before release.
- If logging is required, guard it with `WP_DEBUG` or a plugin setting intended for administrators.
- Never show debug details to unauthenticated visitors or normal front-end users.
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #1051 | WP Accessibility Helper (WAH) | 38 | 61 | 88 | 10k+ | Missing direct file access protection | ||
| #1052 | WP Discord Post Plus – Supports Unlimited Channels | 38 | 116 | 34 | 700 | Text Domain Mismatch | ||
| #1053 | WP Redirects – Contact Form 7 | 38 | 50 | 71 | 400 | Unsafe printing function | ||
| #1054 | External Store for Shopify | 38 | 97 | 33 | 2k+ | Output is not escaped | ||
| #1055 | WPC Product Options for WooCommerce | 38 | 57 | 182 | 4k+ | Non-prefixed global variable | ||
| #1056 | Weather Underground | 38 | 64 | 27 | 3k+ | Output is not escaped | ||
| #1057 | Zoho Campaigns | 38 | 3 | 129 | 3k+ | Non-prefixed global variable | ||
| #1058 | Ad Invalid Click Protector (AICP) | 39 | 78 | 57 | 10k+ | Text Domain Mismatch | ||
| #1059 | AffiliatePages – Pros & Cons, Notice, and CTA Blocks for Affiliates | 39 | 91 | 53 | 2k+ | Output is not escaped | ||
| #1060 | Australia Post WooCommerce Extension | 39 | 99 | 12 | 3k+ | Text Domain Mismatch | ||
| #1061 | AWEOS WP Lock | 39 | 24 | 53 | 400 | Output is not escaped | ||
| #1062 | Benchmark Email Lite | 39 | 86 | 23 | 1k+ | Output is not escaped | ||
| #1063 | Billplz for WooCommerce | 39 | 289 | 65 | 6k+ | Text Domain Mismatch | ||
| #1064 | Blogger Importer Extended | 39 | 55 | 45 | 4k+ | Output is not escaped | ||
| #1065 | Contact Form 7 extension for Google Map fields | 39 | 118 | 58 | 600 | Missing Arg Domain | ||
| #1066 | Content Visibility for Divi Builder | 39 | 184 | 59 | 2k+ | Non Singular String Literal Domain | ||
| #1067 | Culqi | 39 | 571 | 88 | 1k+ | Text Domain Mismatch | ||
| #1068 | Drip for Gravity Forms | 39 | 41 | 21 | 500 | Unsafe printing function | ||
| #1069 | Duplicate Killer – Prevent Duplicate Form Submissions | 39 | 57 | 103 | 1k+ | Non-prefixed global variable | ||
| #1070 | Easy PayPal Events & Tickets | 39 | 28 | 550 | 1k+ | Request data is not unslashed | ||
| #1071 | GF Mollie by Indigo | 39 | 82 | 33 | 900 | Exception output is not escaped | ||
| #1072 | Prisna GWT – Google Website Translator | 39 | 117 | 77 | 8k+ | Text Domain Mismatch | ||
| #1073 | GoSMTP – SMTP for WordPress | 39 | 59 | 42 | 500k+ | Output is not escaped | ||
| #1074 | Gutenverse News – News Blocks for Blog & Magazine Sites | 39 | 37 | 65 | 800 | Non-prefixed hook name | ||
| #1075 | Meks Easy Photo Feed Widget | 39 | 77 | 27 | 10k+ | Output is not escaped | ||
| #1076 | Paystack Add-On for Gravity Forms | 39 | 96 | 31 | 400 | Text Domain Mismatch | ||
| #1077 | Reorder by Term | 39 | 20 | 84 | 1k+ | Request data is not unslashed | ||
| #1078 | Royal Mail Shipping Calculator for WooCommerce | 39 | 61 | 31 | 1k+ | Text Domain Mismatch | ||
| #1079 | Scripts n Styles | 39 | 150 | 92 | 30k+ | Output is not escaped | ||
| #1080 | Shipping by Rules for WooCommerce | 39 | 130 | 48 | 500 | Output is not escaped | ||
| #1081 | Shipping Simulator for WooCommerce | 39 | 120 | 39 | 5k+ | Text Domain Mismatch | ||
| #1082 | Stock Ticker | 39 | 92 | 49 | 2k+ | Output is not escaped | ||
| #1083 | ThemeKit For WordPress | 39 | 149 | 49 | 700 | Output is not escaped | ||
| #1084 | Ultimate Lightbox | 39 | 110 | 59 | 1k+ | Unsafe printing function | ||
| #1085 | CURCY – Multi Currency for WooCommerce – Smoothly on WooCommerce 9.x | 39 | 7 | 222 | 20k+ | Non-prefixed hook name | ||
| #1086 | Eurobank WooCommerce Payment Gateway | 39 | 62 | 63 | 2k+ | Non Singular String Literal Domain | ||
| #1087 | Additional Variation Images Gallery for WooCommerce | 39 | 61 | 127 | 20k+ | Non-prefixed global variable | ||
| #1088 | Claudio Sanches – PagSeguro for WooCommerce | 39 | 87 | 37 | 10k+ | Unsafe printing function | ||
| #1089 | Store Toolkit – WooCommerce Extensions, Quick Enhancements & Handy Tools | 39 | 322 | 66 | 8k+ | Output is not escaped | ||
| #1090 | WP Accessibility | 39 | 199 | 104 | 60k+ | Unsafe printing function | ||
| #1091 | Alt Magic: AI Image Alt Text Generator for WP & Image Rename | 40 | 55 | 118 | 1k+ | Direct Query | ||
| #1092 | Mastodon Autopost | 40 | 41 | 50 | 800 | Output is not escaped | ||
| #1093 | CC BMI Calculator | 40 | 135 | 7 | 800 | Output is not escaped | ||
| #1094 | Contact form 7 TO API + Basic Auth | 40 | 73 | 30 | 1k+ | Non Singular String Literal Domain | ||
| #1095 | FlyWP Helper – Page Cache, Page Optimization, Emails for FlyWP Server Control Panel | 40 | 20 | 81 | 4k+ | Non-prefixed global variable | ||
| #1096 | heatmap for WordPress – Realtime analytics | 40 | 94 | 15 | 1k+ | Non Singular String Literal Domain | ||
| #1097 | JSM Show Order Metadata for WooCommerce HPOS | 40 | 17 | 64 | 700 | Nonce verification recommended | ||
| #1098 | JSM Show Post Metadata | 40 | 15 | 66 | 10k+ | Nonce verification recommended | ||
| #1099 | JSM Show Term Metadata | 40 | 14 | 64 | 900 | Nonce verification recommended | ||
| #1100 | JSM Show User Metadata | 40 | 14 | 64 | 3k+ | Nonce verification recommended |
