WordPress.PHP.DevelopmentFunctions.error_log_var_export
error log var export
Development or debugging behavior appears in code that may run in production.
Why It Shows Up
The scan found logging, debugging, path disclosure, `phpinfo()`, error-reporting changes, or similar development-oriented functions.
Why It Matters
Debug output can leak paths, configuration, request data, stack details, or sensitive runtime information.
How to Fix
- Remove temporary debugging calls before release.
- If logging is required, guard it with `WP_DEBUG` or a plugin setting intended for administrators.
- Never show debug details to unauthenticated visitors or normal front-end users.
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #301 | Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & Checkout Verification | 31 | 288 | 842 | 2k+ | Missing nonce verification | ||
| #302 | Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker | 31 | 63 | 935 | 6k+ | Interpolated SQL is not prepared | ||
| #303 | Worldline Global Online Pay for WooCommerce | 31 | 160 | 86 | 500 | Missing direct file access protection | ||
| #304 | ACME Divi Modules | 32 | 573 | 35 | 400 | Text Domain Mismatch | ||
| #305 | APCu Manager | 32 | 151 | 126 | 10k+ | Output is not escaped | ||
| #306 | GlotPress | 32 | 403 | 103 | 500 | Unsafe printing function | ||
| #307 | GSheetConnector For Ninja Forms | 32 | 165 | 93 | 1k+ | Unsafe printing function | ||
| #308 | GSheetConnector For WPForms – WPForms Google Sheets Integration (Real-Time Sync) | 32 | 120 | 145 | 8k+ | Non-prefixed global variable | ||
| #309 | Showcase IDX Real Estate Search & Lead Capture | 32 | 123 | 52 | 2k+ | Output is not escaped | ||
| #310 | System Dashboard | 32 | 91 | 205 | 1k+ | Request data is not unslashed | ||
| #311 | Thrive Automator | 32 | 84 | 84 | 10k+ | SQL query is not prepared | ||
| #312 | Unbounce Landing Pages | 32 | 169 | 86 | 10k+ | Output is not escaped | ||
| #313 | wpDirAuth | 32 | 250 | 135 | 500 | wp function not compatible with requires wp | ||
| #314 | Advanced Forms for ACF | 33 | 169 | 278 | 3k+ | Non-prefixed hook name | ||
| #315 | AWeber – Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth | 33 | 33 | 229 | 9k+ | Non-prefixed global variable | ||
| #316 | Background Per Page | 33 | 80 | 56 | 700 | Text Domain Mismatch | ||
| #317 | Chatbot with IBM watsonx Assistant | 33 | 324 | 83 | 400 | Non Singular String Literal Domain | ||
| #318 | Countdown Timer | 33 | 311 | 17 | 900 | Text Domain Mismatch | ||
| #319 | FastPixel Cache – Optimize Page Speed: Compress Images, Minify, Clean Database & CDN | 33 | 51 | 333 | 4k+ | Request data is not unslashed | ||
| #320 | GSheetConnector for Forminator Forms | 33 | 128 | 201 | 1k+ | Non-prefixed global variable | ||
| #321 | Frisbii Pay | 33 | 91 | 292 | 1k+ | Non-prefixed global variable | ||
| #322 | Social Rocket – Social Sharing Plugin | 33 | 1,016 | 255 | 1k+ | Unsafe printing function | ||
| #323 | PDF Invoices Italian Add-on for WooCommerce | 33 | 325 | 200 | 5k+ | Non Singular String Literal Domain | ||
| #324 | WebToffee WP Backup and Migration | 33 | 132 | 222 | 5k+ | Non-prefixed global variable | ||
| #325 | Zita Site Library for Elementor | 33 | 107 | 135 | 1k+ | Text Domain Mismatch | ||
| #326 | Campi Moduli Italiani | 34 | 72 | 363 | 500 | Unquoted Complex Placeholder | ||
| #327 | Custom Sidebars – Dynamic Sidebar Classic Widget Area Manager | 34 | 32 | 307 | 100k+ | Non-prefixed global variable | ||
| #328 | Debug Log Manager Tool | 34 | 44 | 143 | 3k+ | Nonce verification recommended | ||
| #329 | FV Gravatar Cache | 34 | 50 | 42 | 600 | Output is not escaped | ||
| #330 | Geolocation IP Detection | 34 | 227 | 167 | 20k+ | Output is not escaped | ||
| #331 | Gitium | 34 | 149 | 57 | 400 | Output is not escaped | ||
| #332 | Child Theme Creator by Orbisius | 34 | 86 | 39 | 10k+ | Output is not escaped | ||
| #333 | Team Members Profile – Employee Directory & Staff Showcase | 34 | 339 | 90 | 600 | Output is not escaped | ||
| #334 | Payoneer Checkout | 34 | 168 | 41 | 5k+ | Exception output is not escaped | ||
| #335 | PagHiper Boleto e PIX para WooCommerce | 34 | 29 | 138 | 1k+ | Missing nonce verification | ||
| #336 | ACF OpenStreetMap Field | 35 | 40 | 46 | 9k+ | Non-prefixed global variable | ||
| #337 | Admin Color Schemer | 35 | 166 | 20 | 1k+ | Exception output is not escaped | ||
| #338 | Air WP Sync – Airtable to WordPress | 35 | 37 | 45 | 1k+ | Non-prefixed hook name | ||
| #339 | BASE Item List | 35 | 4 | 13 | 800 | error log error log | ||
| #340 | bbPress Notify (No-Spam) | 35 | 62 | 66 | 2k+ | wp function not compatible with requires wp | ||
| #341 | Cache Enabler | 35 | 44 | 75 | 90k+ | Input is not sanitized | ||
| #342 | Elementor Website Builder – more than just a page builder | 35 | 46 | 428 | 10m+ | Non-prefixed global variable | ||
| #343 | Embed Extended – Embed Maps, Videos, Websites, Source Codes, and more | 35 | 102 | 92 | 400 | Non-prefixed global variable | ||
| #344 | Kiyoh customer review | 35 | 173 | 68 | 500 | Output is not escaped | ||
| #345 | Less PHP Compiler | 35 | 163 | 47 | 3k+ | Exception output is not escaped | ||
| #346 | Metadata Viewer | 35 | 2 | 11 | 400 | Non-prefixed global variable | ||
| #347 | Post Meta Data Manager | 35 | 30 | 112 | 1k+ | Non-prefixed global variable | ||
| #348 | Related Posts by Taxonomy | 35 | 131 | 97 | 10k+ | Output is not escaped | ||
| #349 | SiteOrigin CSS | 35 | 61 | 84 | 100k+ | Not In Footer | ||
| #350 | Social Sharing Plugin – Social Warfare | 35 | 17 | 143 | 20k+ | Non-prefixed class |
