WordPress.PHP.DevelopmentFunctions.error_log_set_error_handler
error log set error handler
Development or debugging behavior appears in code that may run in production.
Why It Shows Up
The scan found logging, debugging, path disclosure, `phpinfo()`, error-reporting changes, or similar development-oriented functions.
Why It Matters
Debug output can leak paths, configuration, request data, stack details, or sensitive runtime information.
How to Fix
- Remove temporary debugging calls before release.
- If logging is required, guard it with `WP_DEBUG` or a plugin setting intended for administrators.
- Never show debug details to unauthenticated visitors or normal front-end users.
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #151 | URL Image Importer | 26 | 142 | 239 | 700 | Missing nonce verification | ||
| #152 | BackUpWordPress | 27 | 245 | 271 | 90k+ | Non-prefixed global variable | ||
| #153 | Login for Google Apps | 27 | 139 | 85 | 10k+ | Exception output is not escaped | ||
| #154 | Login Security Solution | 27 | 216 | 154 | 4k+ | Output is not escaped | ||
| #155 | MW WP Form | 27 | 334 | 219 | 200k+ | Output is not escaped | ||
| #156 | Code Engine – PHP Snippets, AI Functions & Automation for WordPress | 28 | 124 | 96 | 700 | Non Singular String Literal Domain | ||
| #157 | Maspik – Ultimate Spam Protection | 28 | 212 | 862 | 30k+ | Missing nonce verification | ||
| #158 | FAPI Member | 28 | 279 | 153 | 500 | Exception output is not escaped | ||
| #159 | Fluent Support – Helpdesk & Customer Support Ticket System | 28 | 50 | 271 | 10k+ | Direct Query | ||
| #160 | WPS Bidouille | 28 | 472 | 215 | 10k+ | Output is not escaped | ||
| #161 | WP Synchro – The Ultimate WordPress Migration Tool | 28 | 243 | 244 | 2k+ | Missing Translators Comment | ||
| #162 | pCloud WP Backup | 29 | 120 | 73 | 1k+ | Exception output is not escaped | ||
| #163 | PhastPress | 29 | 95 | 52 | 10k+ | Exception output is not escaped | ||
| #164 | SureForms – Drag & Drop Contact Form & Form Builder, Payment Form, Survey, Quiz & Calculator | 29 | 336 | 198 | 500k+ | Text Domain Mismatch | ||
| #165 | Realbig For WordPress | 30 | 36 | 591 | 1k+ | Non-prefixed global variable | ||
| #166 | Travelers' Map | 30 | 311 | 155 | 1k+ | Output is not escaped | ||
| #167 | WCPOS – Point of Sale (POS) plugin for WooCommerce | 30 | 77 | 228 | 5k+ | Nonce verification recommended | ||
| #168 | FastDup – Fastest WordPress Migration & Duplicator | 31 | 83 | 66 | 5k+ | wp function not compatible with requires wp | ||
| #169 | Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity | 31 | 122 | 131 | 2k+ | Output is not escaped | ||
| #170 | Query Monitor | 31 | 44 | 273 | 200k+ | Non-prefixed class | ||
| #171 | QNAP NAS Backup | 33 | 374 | 70 | 2k+ | Non Singular String Literal Domain | ||
| #172 | Paymattic – Secure, Simple Payment & Donation with Subscription Payments, Recurring Donations, Customer Management | 33 | 538 | 3k+ | Direct Query | |||
| #173 | All-in-One WP Migration and Backup | 34 | 47 | 69 | 5m+ | Missing nonce verification | ||
| #174 | Beeketing for WooCommerce – Marketing Automation to Boost Sales | 34 | 113 | 123 | 600 | SQL query is not prepared | ||
| #175 | Admin Color Schemer | 35 | 166 | 20 | 1k+ | Exception output is not escaped | ||
| #176 | Elementor Website Builder – more than just a page builder | 35 | 46 | 428 | 10m+ | Non-prefixed global variable | ||
| #177 | SAML IDP (Identity Provider) – Login with Website Users | 35 | 13 | 326 | 600 | Non-prefixed global variable | ||
| #178 | Meta pixel for WordPress | 35 | 90 | 40 | 400k+ | Exception output is not escaped | ||
| #179 | Perfecty Push Notifications | 35 | 204 | 213 | 4k+ | SQL query is not prepared | ||
| #180 | ReactPress – Create React App for WordPress | 35 | 26 | 43 | 3k+ | Request data is not unslashed | ||
| #181 | Two Factor Authentication | 35 | 108 | 139 | 20k+ | Output is not escaped | ||
| #182 | XServer Migrator | 35 | 39 | 53 | 10k+ | Interpolated SQL is not prepared | ||
| #183 | Ziina | 35 | 10 | 25 | 2k+ | Input is not sanitized | ||
| #184 | Breadcrumb NavXT | 36 | 102 | 111 | 800k+ | Non Singular String Literal Domain | ||
| #185 | Depicter — Popup & Slider Builder | 36 | 130 | 121 | 80k+ | Exception output is not escaped | ||
| #186 | Better Find and Replace – AI-Powered Suggestions | 36 | 67 | 129 | 40k+ | Missing direct file access protection | ||
| #187 | ClickCease Click Fraud Protection | 37 | 30 | 58 | 10k+ | Non-prefixed class | ||
| #188 | Accessibility by AllAccessible | 39 | 200 | 82 | 2k+ | Unsafe printing function | ||
| #189 | Debug Bar | 41 | 64 | 25 | 20k+ | Output is not escaped | ||
| #190 | Developer Loggers for Simple History | 41 | 46 | 28 | 400 | Text Domain Mismatch | ||
| #191 | FluentAffiliate – Affiliate Program Management Suite, Affiliates Manager | 41 | 115 | 14 | 1k+ | Exception output is not escaped | ||
| #192 | Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution | 42 | 111 | 17 | 20k+ | Exception output is not escaped | ||
| #193 | WP Console – WordPress PHP Console powered by PsySH | 53 | 34 | 48 | 20k+ | Exception output is not escaped | ||
| #194 | CHEQ Essentials | 56 | 14 | 49 | 700 | Request data is not unslashed | ||
| #195 | wp-Typography | 67 | 91 | 33 | 20k+ | Missing direct file access protection | ||
| #196 | Black Bar | 69 | 78 | 39 | 600 | Short PHP open tag found | ||
| #197 | Debug | 69 | 25 | 34 | 2k+ | Input is not sanitized | ||
| #198 | Real Thumbnail Generator: Efficient regeneration of thumbnails in all sizes | 85 | 5 | 58 | 1k+ | Non-prefixed constant | ||
| #199 | Post Export Import with Media | 90 | 34 | 41 | 1k+ | Missing Translators Comment | ||
| #200 | WPSSO Tune WP Image Editors | 91 | 35 | 10 | 900 | Missing Translators Comment |
