WordPress.Security.PluginMenuSlug.Using__FILE__
Plugin menu slug uses __FILE__
Plugin Check reported a security-sensitive coding pattern that needs review.
Why It Shows Up
The finding came from a security-focused WordPress coding standard or Plugin Check rule.
Why It Matters
Security findings often involve trust boundaries: request input, browser output, redirects, database access, capabilities, or filesystem behavior.
How to Fix
- Identify the untrusted value or privileged action involved.
- Add validation, sanitization, escaping, nonce checks, capability checks, or prepared SQL as appropriate.
- Rerun Plugin Check after the code path is fixed.
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #151 | ImageMagick Sharpen Resized Images | 54 | 22 | 6 | 1k+ | Output is not escaped | ||
| #152 | WP Login Timeout Settings | 54 | 27 | 7 | 700 | Output is not escaped | ||
| #153 | WP Post Navigation | 54 | 14 | 23 | 1k+ | Output is not escaped | ||
| #154 | Ascending Posts by Fly Plugins | 55 | 23 | 13 | 500 | Text Domain Mismatch | ||
| #155 | Custom Upload Dir | 55 | 63 | 7 | 5k+ | Missing Arg Domain | ||
| #156 | Virtual Robots.txt | 55 | 10 | 21 | 40k+ | Input is not validated | ||
| #157 | Admin Bar Fix | 56 | 40 | 18 | 400 | Text Domain Mismatch | ||
| #158 | BotPenguin – Generative AI Chatbot with Live Chat & ChatGPT | 56 | 12 | 7 | 700 | Unsafe printing function | ||
| #159 | Free Live Chat Support | 56 | 9 | 20 | 600 | Output is not escaped | ||
| #160 | WP Adsterra Dashboard | 57 | 22 | 21 | 400 | wp function not compatible with requires wp | ||
| #161 | WP Wrapper | 57 | 13 | 29 | 600 | Input is not validated | ||
| #162 | Remove CPT base | 58 | 15 | 16 | 10k+ | Input is not sanitized | ||
| #163 | Chat Button & Custom ChatGPT-Powered Bot by GetButton.io | 58 | 26 | 8 | 20k+ | Non-prefixed function | ||
| #164 | WP-SWFObject | 60 | 14 | 24 | 1k+ | Deprecated parameter: add_option parameter 3 | ||
| #165 | Compact WP Audio Player | 61 | 12 | 21 | 20k+ | Non-prefixed function | ||
| #166 | jQuery Lightbox | 61 | 22 | 3 | 1k+ | Output is not escaped | ||
| #167 | WP-UTF8-Excerpt | 61 | 17 | 10 | 800 | Unsafe printing function | ||
| #168 | WP YouTube Player | 61 | 14 | 17 | 1k+ | Output is not escaped | ||
| #169 | Zen Menu Logic | 62 | 19 | 3 | 1k+ | Output is not escaped | ||
| #170 | Slightly troublesome permalink | 63 | 24 | 10 | 1k+ | Non Singular String Literal Domain | ||
| #171 | Evermore | 64 | 8 | 12 | 1k+ | Input is not validated | ||
| #172 | Master Post Advert | 64 | 26 | 4 | 1k+ | Unsafe printing function | ||
| #173 | TP Show Product Images on Checkout Page for WooCommerce | 64 | 16 | 5 | 500 | Setting is missing a sanitization callback | ||
| #174 | CP Media Player – Audio Player and Video Player | 66 | 224 | 48 | 3k+ | Text Domain Mismatch | ||
| #175 | Free Property Valuation (Lead Generator) / Kostenlose Immobilienbewertung | 66 | 11 | 5 | 600 | Unsafe printing function | ||
| #176 | WP Simple Adsense Insertion | 66 | 3 | 29 | 3k+ | Input is not validated | ||
| #177 | Add Logo to Admin | 67 | 14 | 3 | 7k+ | Unsafe printing function | ||
| #178 | Shoutcast Icecast HTML5 Radio Player | 67 | 17 | 10 | 1k+ | Input is not validated | ||
| #179 | WP Favicon | 68 | 25 | 9 | 500 | Non Singular String Literal Domain | ||
| #180 | Colorize Mobile Browser Address bar | 69 | 26 | 3 | 1k+ | Output is not escaped | ||
| #181 | Dashboard Commander | 69 | 13 | 2 | 900 | Output is not escaped | ||
| #182 | Another Mailchimp Widget | 71 | 28 | 17 | 4k+ | Missing Translators Comment | ||
| #183 | Bootstrap Shortcodes | 71 | 21 | 11 | 5k+ | Missing direct file access protection | ||
| #184 | Social Chat Widget (⚡ by Callbell) | 71 | 11 | 6 | 600 | Output is not escaped | ||
| #185 | Customizer for WooCommerce | 72 | 10 | 13 | 800 | Nonce verification recommended | ||
| #186 | Albacross for WordPress | 73 | 18 | 5 | 1k+ | Text Domain Mismatch | ||
| #187 | Block Plugin Update | 73 | 9 | 10 | 6k+ | Missing direct file access protection | ||
| #188 | Freetobook Responsive Widget | 73 | 5 | 14 | 500 | Input is not sanitized | ||
| #189 | Datareporter Webcare | 74 | 12 | 21 | 700 | Non-prefixed global variable | ||
| #190 | Vello Booking Calendar | 74 | 10 | 2 | 500 | Unsafe printing function | ||
| #191 | FareHarbor for WordPress | 75 | 18 | 9 | 9k+ | Output is not escaped | ||
| #192 | Logos Reftagger | 75 | 12 | 15 | 10k+ | Deprecated parameter: add_option parameter 3 | ||
| #193 | wp-forecast | 75 | 263 | 117 | 5k+ | Missing Arg Domain | ||
| #194 | Custom Cursor For WP | 77 | 10 | 7 | 1k+ | Setting is missing a sanitization callback | ||
| #195 | FD Footnotes Plugin | 77 | 28 | 5 | 1k+ | Non Singular String Literal Domain | ||
| #196 | Modern Footnotes | 77 | 18 | 6 | 6k+ | Output is not escaped | ||
| #197 | Tock Widget | 78 | 6 | 9 | 400 | Missing direct file access protection | ||
| #198 | WP Automatic Updates | 79 | 50 | 7 | 400 | Text Domain Mismatch | ||
| #199 | WP Updates Settings | 79 | 7 | 8 | 900 | Unsafe printing function | ||
| #200 | Fix Another Update In Progress | 80 | 7 | 1 | 8k+ | Output is not escaped |
