WordPress.PHP.DevelopmentFunctions.error_log_var_export
error log var export
Development or debugging behavior appears in code that may run in production.
Why It Shows Up
The scan found logging, debugging, path disclosure, `phpinfo()`, error-reporting changes, or similar development-oriented functions.
Why It Matters
Debug output can leak paths, configuration, request data, stack details, or sensitive runtime information.
How to Fix
- Remove temporary debugging calls before release.
- If logging is required, guard it with `WP_DEBUG` or a plugin setting intended for administrators.
- Never show debug details to unauthenticated visitors or normal front-end users.
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #251 | Lean Player – Video and Audio Player with Playlist for WordPress, Elementor and Gutenberg | 27 | 1,615 | 466 | 2k+ | Text Domain Mismatch | ||
| #252 | BackUpWordPress | 27 | 245 | 271 | 90k+ | Non-prefixed global variable | ||
| #253 | Foxtool All-in-One: Contact chat button, Custom login, Media optimize images | 27 | 1,629 | 360 | 7k+ | Unsafe printing function | ||
| #254 | Hester Core | 27 | 253 | 103 | 10k+ | Output is not escaped | ||
| #255 | Loco Translate | 27 | 451 | 225 | 1m+ | Output is not escaped | ||
| #256 | LWS Optimize – All-in-One Speed Booster & Cache Tools | 27 | 34 | 518 | 10k+ | Non-prefixed global variable | ||
| #257 | Memberful – Membership Plugin | 27 | 351 | 336 | 1k+ | Text Domain Mismatch | ||
| #258 | SEO Booster | 27 | 422 | 1,456 | 1k+ | Non-prefixed global variable | ||
| #259 | SV Tracking Manager | 27 | 968 | 129 | 1k+ | Output is not escaped | ||
| #260 | Theme One Click Demo Importer | 27 | 210 | 157 | 500 | Text Domain Mismatch | ||
| #261 | WP Activity Log | 27 | 96 | 230 | 300k+ | Nonce verification recommended | ||
| #262 | Code Engine – PHP Snippets, AI Functions & Automation for WordPress | 28 | 124 | 96 | 700 | Non Singular String Literal Domain | ||
| #263 | Dynamic User Directory | 28 | 403 | 256 | 1k+ | Output is not escaped | ||
| #264 | FAPI Member | 28 | 279 | 153 | 500 | Exception output is not escaped | ||
| #265 | Kadence Starter Templates — Predesigned Website Templates | 28 | 312 | 215 | 200k+ | Missing Arg Domain | ||
| #266 | Notification for Telegram | 28 | 189 | 93 | 4k+ | Output is not escaped | ||
| #267 | Product Sync for WooCommerce | 28 | 158 | 375 | 400 | Direct Query | ||
| #268 | Query Wrangler | 28 | 628 | 229 | 700 | Output is not escaped | ||
| #269 | Praison AI SEO | 28 | 649 | 306 | 1k+ | Text Domain Mismatch | ||
| #270 | WeeConnectPay – Clover Payment Gateway for WooCommerce | 28 | 179 | 171 | 500 | Exception output is not escaped | ||
| #271 | WPify Woo – Withdrawal, CRN/VAT, QR payments, Heureka and more for WooCommerce | 28 | 177 | 226 | 5k+ | Output is not escaped | ||
| #272 | WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) | 28 | 209 | 217 | 10k+ | Exception output is not escaped | ||
| #273 | Better Google Analytics | 29 | 376 | 869 | 2k+ | Non-prefixed global variable | ||
| #274 | Everest Toolkit | 29 | 145 | 141 | 1k+ | Missing Translators Comment | ||
| #275 | pCloud WP Backup | 29 | 120 | 73 | 1k+ | Exception output is not escaped | ||
| #276 | Responder | 29 | 77 | 185 | 3k+ | Non-prefixed global variable | ||
| #277 | SQLite Database Integration | 29 | 161 | 89 | 3k+ | Exception output is not escaped | ||
| #278 | SureForms – Drag & Drop Contact Form & Form Builder, Payment Form, Survey, Quiz & Calculator | 29 | 336 | 198 | 500k+ | Text Domain Mismatch | ||
| #279 | Wenprise Alipay Gateway For WooCommerce | 29 | 113 | 68 | 700 | Exception output is not escaped | ||
| #280 | WPComplete | 29 | 383 | 333 | 1k+ | Output is not escaped | ||
| #281 | Aitasi Coming Soon | 30 | 516 | 186 | 1k+ | Output is not escaped | ||
| #282 | aThemes Starter Sites | 30 | 262 | 195 | 40k+ | Text Domain Mismatch | ||
| #283 | AutoWP – AI Content Writer & Rewriter | 30 | 548 | 370 | 1k+ | Text Domain Mismatch | ||
| #284 | Invisible reCaptcha for WordPress | 30 | 90 | 185 | 80k+ | Input is not sanitized | ||
| #285 | OoohBoi Steroids for Elementor | 30 | 2,059 | 100 | 40k+ | Text Domain Mismatch | ||
| #286 | گرویتی فرم فارسی | 30 | 205 | 157 | 20k+ | Text Domain Mismatch | ||
| #287 | SMTP for Amazon SES – YaySMTP | 30 | 197 | 122 | 3k+ | Exception output is not escaped | ||
| #288 | Travelers' Map | 30 | 311 | 155 | 1k+ | Output is not escaped | ||
| #289 | Urvanov Syntax Highlighter | 30 | 221 | 87 | 3k+ | Output is not escaped | ||
| #290 | User Access Manager | 30 | 393 | 171 | 10k+ | Output is not escaped | ||
| #291 | Checkout with Cash App on WooCommerce | 30 | 122 | 308 | 2k+ | Non-prefixed global variable | ||
| #292 | Dropify | 30 | 130 | 252 | 2k+ | Nonce verification recommended | ||
| #293 | Newsletter Sign-Up for CleverReach | 31 | 174 | 72 | 2k+ | Output is not escaped | ||
| #294 | Compliance by Hu-manity.co | 31 | 153 | 335 | 900k+ | Missing nonce verification | ||
| #295 | Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity | 31 | 122 | 131 | 2k+ | Output is not escaped | ||
| #296 | افزونه پیامک ووکامرس Persian WooCommerce SMS | 31 | 72 | 269 | 40k+ | Nonce verification recommended | ||
| #297 | Post Pay Counter | 31 | 639 | 238 | 1k+ | Output is not escaped | ||
| #298 | reCAPTCHA in WP comments form | 31 | 264 | 60 | 8k+ | Output is not escaped | ||
| #299 | Social Share Buttons | 31 | 462 | 156 | 1k+ | Text Domain Mismatch | ||
| #300 | SpeedyCache – Cache, Optimization, Performance | 31 | 65 | 118 | 600k+ | Input is not validated |
