WordPress.PHP.DevelopmentFunctions.error_log_var_export
error log var export
Development or debugging behavior appears in code that may run in production.
Why It Shows Up
The scan found logging, debugging, path disclosure, `phpinfo()`, error-reporting changes, or similar development-oriented functions.
Why It Matters
Debug output can leak paths, configuration, request data, stack details, or sensitive runtime information.
How to Fix
- Remove temporary debugging calls before release.
- If logging is required, guard it with `WP_DEBUG` or a plugin setting intended for administrators.
- Never show debug details to unauthenticated visitors or normal front-end users.
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #351 | Solid Performance – Your No-Code Caching, Performance, & Page Speed Solution | 35 | 75 | 61 | 4k+ | Exception output is not escaped | ||
| #352 | StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More | 35 | 519 | 600 | Non-prefixed global variable | |||
| #353 | Starter Sites & Templates by Neve | 35 | 28 | 88 | 100k+ | Non-prefixed hook name | ||
| #354 | Use Google Libraries | 35 | 13 | 5 | 10k+ | Hidden files included | ||
| #355 | WP Cassify | 35 | 106 | 143 | 700 | Missing nonce verification | ||
| #356 | wpLingua – Automatic translation – Translate and make website multilingual | 35 | 79 | 167 | 2k+ | Nonce verification recommended | ||
| #357 | SOOZ – AI for SEO – Bulk Generate Focus Keyphrases, Metadata, Alt Text (SEO Autopilot) | 36 | 4 | 342 | 2k+ | Nonce verification recommended | ||
| #358 | authLdap | 36 | 47 | 30 | 4k+ | Exception output is not escaped | ||
| #359 | Breadcrumb NavXT | 36 | 102 | 111 | 800k+ | Non Singular String Literal Domain | ||
| #360 | Code Snippets | 36 | 34 | 203 | 1m+ | Nonce verification recommended | ||
| #361 | Database Collation Fix | 36 | 50 | 32 | 1k+ | Output is not escaped | ||
| #362 | Duitku Payment Gateway | 36 | 507 | 107 | 700 | Text Domain Mismatch | ||
| #363 | Rara One Click Demo Import | 36 | 122 | 98 | 20k+ | Missing Translators Comment | ||
| #364 | Gmail SMTP | 37 | 85 | 71 | 10k+ | Unsafe printing function | ||
| #365 | LiveAgent – Omnichannel Help Desk & Live Chat Software | 37 | 125 | 142 | 400 | Non Singular String Literal Domain | ||
| #366 | Max Mega Menu | 37 | 249 | 174 | 300k+ | Output is not escaped | ||
| #367 | Page scroll to id | 37 | 38 | 120 | 100k+ | Missing nonce verification | ||
| #368 | Sensei LMS Certificates | 37 | 97 | 362 | 4k+ | Non-prefixed global variable | ||
| #369 | ViaBill – WooCommerce | 37 | 437 | 86 | 500 | Text Domain Mismatch | ||
| #370 | Orders Tracking for WooCommerce | 37 | 7 | 312 | 10k+ | Request data is not unslashed | ||
| #371 | Módulo PagSeguro | 37 | 90 | 46 | 1k+ | Unsafe printing function | ||
| #372 | Wordable – Export Google Docs to WordPress | 37 | 47 | 63 | 2k+ | Output is not escaped | ||
| #373 | Ashe Extra | 38 | 109 | 54 | 3k+ | Text Domain Mismatch | ||
| #374 | Broadcast | 38 | 21 | 107 | 1k+ | Direct Query | ||
| #375 | DefendWP Firewall | 39 | 16 | 203 | 3k+ | Non-prefixed global variable | ||
| #376 | Events Manager – Zoom Integration | 39 | 141 | 43 | 700 | Output is not escaped | ||
| #377 | Atomic Edge Security – Firewall, Malware Scan and Login Security | 40 | 12 | 184 | 700 | Non-prefixed global variable | ||
| #378 | JSM Show Order Metadata for WooCommerce HPOS | 40 | 17 | 64 | 700 | Nonce verification recommended | ||
| #379 | JSM Show Post Metadata | 40 | 15 | 66 | 10k+ | Nonce verification recommended | ||
| #380 | JSM Show Term Metadata | 40 | 14 | 64 | 900 | Nonce verification recommended | ||
| #381 | JSM Show User Metadata | 40 | 14 | 64 | 3k+ | Nonce verification recommended | ||
| #382 | Responsive Plus – Elementor Templates & Starter Sites | 40 | 46 | 305 | 10k+ | Non-prefixed global variable | ||
| #383 | Search with Typesense | 40 | 81 | 122 | 700 | Non-prefixed global variable | ||
| #384 | iCount Payment Gateway | 41 | 153 | 22 | 500 | Text Domain Mismatch | ||
| #385 | WP Crontrol | 41 | 20 | 91 | 300k+ | Nonce verification recommended | ||
| #386 | SmartVideo – Video Player and CDN | 44 | 295 | 44 | 1k+ | Text Domain Mismatch | ||
| #387 | CDEKDelivery | 46 | 75 | 2k+ | Nonce verification recommended | |||
| #388 | Whitelist IP For Limit Login Attempts | 48 | 18 | 12 | 500 | Output is not escaped | ||
| #389 | Ecommerce Fabrick | 49 | 4 | 135 | 1k+ | Nonce verification recommended | ||
| #390 | SKT Themes Demo Import | 49 | 218 | 104 | 4k+ | Text Domain Mismatch | ||
| #391 | Product Slider, Product Grid, Product Masonry | 49 | 55 | 144 | 10k+ | wp function not compatible with requires wp | ||
| #392 | Theme Demo Import | 50 | 101 | 95 | 5k+ | Non-prefixed hook name | ||
| #393 | Trustpilot Reviews | 51 | 14 | 52 | 30k+ | Missing nonce verification | ||
| #394 | GSheetConnector for Gravity Forms – Send Gravity Forms Entries to Google Sheets in Real-Time | 52 | 26 | 27 | 1k+ | Exception output is not escaped | ||
| #395 | Weight Based Shipping for WooCommerce | 53 | 48 | 41 | 60k+ | Missing direct file access protection | ||
| #396 | WP Console – WordPress PHP Console powered by PsySH | 53 | 34 | 48 | 20k+ | Exception output is not escaped | ||
| #397 | FluentSnippets – High-Performance Code Snippets, Header & Footer Code, Custom CSS & PHP Code Manager | 56 | 31 | 27 | 50k+ | Nonce verification recommended | ||
| #398 | Form data to kintone | 56 | 25 | 22 | 1k+ | Output is not escaped | ||
| #399 | CIELO API PIX, credit card, debit payment for WooCommerce | 56 | 11 | 121 | 700 | Nonce verification recommended | ||
| #400 | PDF invoice for WP ERP | 58 | 96 | 134 | 2k+ | Non-prefixed global variable |
