WordPress.Security.SafeRedirect.wp_redirect_wp_redirect
wp redirect wp redirect
Plugin Check reported a security-sensitive coding pattern that needs review.
Why It Shows Up
The finding came from a security-focused WordPress coding standard or Plugin Check rule.
Why It Matters
Security findings often involve trust boundaries: request input, browser output, redirects, database access, capabilities, or filesystem behavior.
How to Fix
- Identify the untrusted value or privileged action involved.
- Add validation, sanitization, escaping, nonce checks, capability checks, or prepared SQL as appropriate.
- Rerun Plugin Check after the code path is fixed.
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #851 | WP Zoho for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms – CRM, Bigin | 27 | 692 | 381 | 3k+ | Text Domain Mismatch | ||
| #852 | Divi Collage | 27 | 516 | 1,183 | 700 | Non-prefixed global variable | ||
| #853 | Comment Link Remove and Other Comment Tools | 27 | 691 | 132 | 7k+ | Text Domain Mismatch | ||
| #854 | Duplicate Post | 27 | 447 | 274 | 300k+ | Unsafe printing function | ||
| #855 | Polls CP | 27 | 399 | 500 | 400 | Output is not escaped | ||
| #856 | Cyrlitera – Transliteration of Links and File Names | 27 | 453 | 204 | 40k+ | Output is not escaped | ||
| #857 | Echo Knowledge Base – Documentation, FAQs, Chat & Smart Search | 27 | 289 | 751 | 10k+ | Output is not escaped | ||
| #858 | Embedder for Google Reviews | 27 | 531 | 1,333 | 6k+ | Non-prefixed global variable | ||
| #859 | CM Tooltip Glossary | 27 | 611 | 188 | 7k+ | Output is not escaped | ||
| #860 | Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin | 27 | 122 | 135 | 3k+ | Non-prefixed global variable | ||
| #861 | Extra Product Options for WooCommerce | 27 | 548 | 1,342 | 600 | Non-prefixed global variable | ||
| #862 | Foxtool All-in-One: Contact chat button, Custom login, Media optimize images | 27 | 1,629 | 360 | 7k+ | Unsafe printing function | ||
| #863 | StylePress for Elementor | 27 | 767 | 283 | 600 | Text Domain Mismatch | ||
| #864 | Login for Google Apps | 27 | 139 | 85 | 10k+ | Exception output is not escaped | ||
| #865 | Gravity Forms + Stripe | 27 | 368 | 210 | 600 | Output is not escaped | ||
| #866 | GSpeech TTS – WordPress Text To Speech Plugin | 27 | 842 | 333 | 3k+ | Output is not escaped | ||
| #867 | HM Multiple Roles | 27 | 537 | 1,287 | 1k+ | Non-prefixed global variable | ||
| #868 | ImageRecycle pdf & image compression | 27 | 329 | 204 | 1k+ | Text Domain Mismatch | ||
| #869 | Import Eventbrite Events | 27 | 156 | 575 | 3k+ | Non-prefixed global variable | ||
| #870 | Ray Enterprise Translation | 27 | 87 | 606 | 8k+ | Non-prefixed global variable | ||
| #871 | Liza Widget For Spotify and Elementor | 27 | 609 | 1,287 | 1k+ | Non-prefixed global variable | ||
| #872 | Loco Translate | 27 | 451 | 225 | 1m+ | Output is not escaped | ||
| #873 | Login Security Solution | 27 | 216 | 154 | 4k+ | Output is not escaped | ||
| #874 | MakeCommerce for WooCommerce | 27 | 826 | 452 | 3k+ | Text Domain Mismatch | ||
| #875 | Online Booking & Scheduling Calendar for WordPress by vcita | 27 | 473 | 161 | 1k+ | Output is not escaped | ||
| #876 | Memberful – Membership Plugin | 27 | 351 | 336 | 1k+ | Text Domain Mismatch | ||
| #877 | MLSImport – Download and synchronize real estate data from various MLS (Multiple Listing Services) | 27 | 154 | 551 | 5k+ | Non-prefixed global variable | ||
| #878 | MW WP Form | 27 | 334 | 219 | 200k+ | Output is not escaped | ||
| #879 | Nextend Social Login and Register | 27 | 1,668 | 243 | 200k+ | Output is not escaped | ||
| #880 | picu – Online Photo Proofing Gallery | 27 | 613 | 325 | 2k+ | Output is not escaped | ||
| #881 | Pie Register – User Registration, Profiles & Content Restriction | 27 | 1,779 | 1k+ | Non-prefixed global variable | |||
| #882 | PublishPress Permissions: Control User Access for Posts, Pages, Categories, Tags | 27 | 424 | 323 | 10k+ | Missing Translators Comment | ||
| #883 | Restrict for Elementor | 27 | 530 | 1,223 | 900 | Non-prefixed global variable | ||
| #884 | Robokassa payment gateway for Woocommerce | 27 | 95 | 211 | 3k+ | Non-prefixed global variable | ||
| #885 | Shipit | 27 | 371 | 209 | 400 | Text Domain Mismatch | ||
| #886 | Side Cart Woocommerce | Woocommerce Cart | 27 | 490 | 439 | 80k+ | Output is not escaped | ||
| #887 | Sign-up Sheets | 27 | 325 | 363 | 1k+ | Output is not escaped | ||
| #888 | Simple Download Monitor | 27 | 218 | 273 | 20k+ | Output is not escaped | ||
| #889 | Hubbub Lite – Fast, free social sharing and follow buttons | 27 | 337 | 172 | 30k+ | Text Domain Mismatch | ||
| #890 | Social Web Suite – Social Media Auto Post, Social Media Auto Publish | 27 | 74 | 164 | 500 | Non-prefixed global variable | ||
| #891 | SV Tracking Manager | 27 | 968 | 129 | 1k+ | Output is not escaped | ||
| #892 | Terms & Conditions Per Product | 27 | 533 | 1,336 | 800 | Non-prefixed global variable | ||
| #893 | Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More | 27 | 165 | 430 | 100k+ | Non-prefixed global variable | ||
| #894 | Transbank Webpay | 27 | 198 | 211 | 10k+ | Non-prefixed global variable | ||
| #895 | Wiremo – Product Reviews for WooCommerce | 27 | 445 | 212 | 700 | Output is not escaped | ||
| #896 | Tabbed Category Product Listing for Woocommerce | 27 | 423 | 111 | 1k+ | Text Domain Mismatch | ||
| #897 | Content Pilot – Autoblogging & Affiliate Marketing Suite | 27 | 299 | 269 | 800 | Output is not escaped | ||
| #898 | Email Marketing Plugin – WP Email Capture | 27 | 383 | 262 | 1k+ | Output is not escaped | ||
| #899 | WP Events Manager | 27 | 294 | 415 | 30k+ | Output is not escaped | ||
| #900 | WP Hide & Security Enhancer | 27 | 124 | 375 | 50k+ | Input is not sanitized |
