PluginScore

WordPress.Security.PluginMenuSlug.Using__FILE__

Using FILE

Plugin Check reported a security-sensitive coding pattern that needs review.

critical weight

Why It Shows Up

The finding came from a security-focused WordPress coding standard or Plugin Check rule.

Why It Matters

Security findings often involve trust boundaries: request input, browser output, redirects, database access, capabilities, or filesystem behavior.

How to Fix

  • Identify the untrusted value or privileged action involved.
  • Add validation, sanitization, escaping, nonce checks, capability checks, or prepared SQL as appropriate.
  • Rerun Plugin Check after the code path is fixed.

References

WordPress validating, sanitizing, and escapingWordPress escaping functionsWordPress nonces

Affected Plugins

RankPluginScoreErrorsWarningsInstallsUpdatedTop Issue
#51Crisp – Live Chat and Chatbot40242020k+Unsafe Printing Function
#52Ultimate Noindex Nofollow Tool II4038513k+Input Not Validated
#53Visual Editor Custom Buttons4030484k+Output Not Escaped
#54Wider Admin Menu4076172k+Output Not Escaped
#55AddQuicktag418610100k+Output Not Escaped
#56MouseWheel Smooth Scroll411047100k+Text Domain Mismatch
#57OSS Aliyun4119403k+Missing Unslash
#58Share a Draft413963k+Output Not Escaped
#59Etsy Shop4258213k+Unsafe Printing Function
#60Login No Captcha reCAPTCHA42452460k+Unsafe Printing Function
#61PDF Thumbnail Generator4226162k+Output Not Escaped
#62reCAPTCHA for WooCommerce42803140k+Output Not Escaped
#63Ultimate Category Excluder42222650k+Missing
#64Format Media Titles453345k+Unsafe Printing Function
#65Goftino45162010k+Output Not Escaped
#66Website Article Monetization By MageNet47172410k+Output Not Escaped
#67Disable Author Pages482356k+Unsafe Printing Function
#68Block Plugin Update4916156k+missing direct file access protection
#69Disable Site502634k+Output Not Escaped
#70WP SVG Images50581230k+Text Domain Mismatch
#71Age Gate Lite522832k+Output Not Escaped
#72Meta Generator and Version Info Remover52202810k+Non Prefixed Function Found
#73Podium5221235k+missing direct file access protection
#74CSV Importer5424113k+file system operations fclose
#75Custom Upload Dir556375k+Missing Arg Domain
#76Virtual Robots.txt55102140k+Input Not Validated
#77Remove CPT base58151610k+Input Not Sanitized
#78Chat Button & Custom ChatGPT-Powered Bot by GetButton.io5826820k+Non Prefixed Function Found
#79Compact WP Audio Player61122120k+Non Prefixed Function Found
#80CP Media Player – Audio Player and Video Player66224483k+Text Domain Mismatch
#81WP Simple Adsense Insertion663293k+Input Not Validated
#82Add Logo to Admin671437k+Unsafe Printing Function
#83Another Mailchimp Widget7128175k+Missing Translators Comment
#84Bootstrap Shortcodes7121115k+missing direct file access protection
#85FareHarbor for WordPress751899k+Output Not Escaped
#86Logos Reftagger75121510k+Add option Param3Found
#87wp-forecast752631175k+Missing Arg Domain
#88Modern Footnotes771866k+Output Not Escaped
#89Fix Another Update In Progress80718k+Output Not Escaped
#90AWEOS Google Maps iframe load per click811173k+Text Domain Mismatch
#91LocaliQ – Tracking Code8512112k+Non Prefixed Function Found
#92Donorbox – Free Recurring Donation Plugin and Fundraising Platform87568k+Missing Arg Domain
#93Local Business Schema (JSON-LD) Lite9015583k+Text Domain Mismatch
#94Pinyin Slugs9713k+Using FILE