PluginScore

WordPress.Security.PluginMenuSlug.Using__FILE__

Plugin menu slug uses __FILE__

Plugin Check reported a security-sensitive coding pattern that needs review.

critical weight

Why It Shows Up

The finding came from a security-focused WordPress coding standard or Plugin Check rule.

Why It Matters

Security findings often involve trust boundaries: request input, browser output, redirects, database access, capabilities, or filesystem behavior.

How to Fix

  • Identify the untrusted value or privileged action involved.
  • Add validation, sanitization, escaping, nonce checks, capability checks, or prepared SQL as appropriate.
  • Rerun Plugin Check after the code path is fixed.

References

WordPress validating, sanitizing, and escapingWordPress escaping functionsWordPress nonces

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#1WPOSS阿里云对象存储19269315900Non-prefixed namespace
#2WPQiNiu七牛云对象存储19138612400Non-prefixed global variable
#3Smart Forms – when you need more than just a contact form217765745k+Output is not escaped
#4HeadSpace2 SEO229403603k+Text Domain Mismatch
#5History Log by click5226751,290400Direct Query
#6Quick Contact Form222606231k+Non-prefixed function
#7Master Accordion ( Former WP Awesome FAQ Plugin )221,7741,286700Non-prefixed global variable
#8BlossomThemes Email Newsletter2333723920k+Output is not escaped
#9Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe239,63127,6131k+Non-prefixed global variable
#10WP Free SSL237351,3451k+Non-prefixed global variable
#11WP Travel Engine – Tour Booking Plugin – Tour Operator Software232,0915,83720k+Non-prefixed global variable
#12SEO Redirection Plugin – 301 Redirect Manager2427272510k+Non-prefixed global variable
#13WP Meta and Date Remover246651,31490k+Non-prefixed global variable
#14xili-language241,501523600Output is not escaped
#15Booking Package251,6983,97810k+Missing nonce verification
#16Sitemap by click5252861326k+Unsafe printing function
#17PDF Builder for WooCommerce. Create invoices,packing slips and more253725062k+Non-prefixed global variable
#18All 404 Redirect to Homepage27139250200k+date date
#19iQ Block Country2716424520k+Request data is not unslashed
#20Online Booking & Scheduling Calendar for WordPress by vcita274731611k+Output is not escaped
#21Stream Video Player27220135600Output is not escaped
#22VOD Infomaniak2779738520k+Output is not escaped
#23Custom Field Template2857553030k+wp function not compatible with requires wp
#24Geo Mashup287752321k+Text Domain Mismatch
#25DB Cache Reloaded Fix29133422k+Output is not escaped
#26Widget Manager Light3023383600Text Domain Mismatch
#27Widgetize Pages Light301451043k+Output is not escaped
#28Sidebar Manager Light31221761k+Text Domain Mismatch
#29WP Easy Uploader31202113500Non Singular String Literal Domain
#30WP125311781843k+Unsafe printing function
#31wpDirAuth32250135500wp function not compatible with requires wp
#32Countdown Timer3331117900Text Domain Mismatch
#33Epeken All Kurir for Woocommerce33581,266400Missing nonce verification
#34Inactive User Deleter33453170800Output is not escaped
#35Janolaw AGB Hosting33198111k+Short PHP open tag found
#36Offen33313115500Output is not escaped
#37AGCA – Custom Dashboard & Login Page343504420k+Unsafe printing function
#38Audit Trail349010710k+Unsafe printing function
#39Forms: 3rd-Party Integration342341125k+Output is not escaped
#40Hitsteps Web Analytics34410322800Output is not escaped
#41HTML Import 234273265k+Unsafe printing function
#42Search Meter341919420k+Output is not escaped
#43Shift8 CDN348125500Output is not escaped
#44Xml Sitemap Generator347247400SQL query is not prepared
#45Kiyoh customer review3517368500Output is not escaped
#46Pixeline's Email Protector35804800Text Domain Mismatch
#47ReOrder Posts within Categories35392077k+Non-prefixed global variable
#48Simple Header Footer HTML353053k+Output is not escaped
#49User Photo35112683k+Output is not escaped
#50Easy Accept Payments via PayPal353221287k+Text Domain Mismatch