WordPress.Security.SafeRedirect.wp_redirect_wp_redirect
wp redirect wp redirect
Plugin Check reported a security-sensitive coding pattern that needs review.
Why It Shows Up
The finding came from a security-focused WordPress coding standard or Plugin Check rule.
Why It Matters
Security findings often involve trust boundaries: request input, browser output, redirects, database access, capabilities, or filesystem behavior.
How to Fix
- Identify the untrusted value or privileged action involved.
- Add validation, sanitization, escaping, nonce checks, capability checks, or prepared SQL as appropriate.
- Rerun Plugin Check after the code path is fixed.
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #901 | wp-mpdf | 27 | 123 | 382 | 1k+ | Non-prefixed global variable | ||
| #902 | Worthy – VG WORT Integration für WordPress | 27 | 1,343 | 773 | 1k+ | Output is not escaped | ||
| #903 | Redirection for Contact Form 7 | 27 | 34 | 374 | 200k+ | Non-prefixed global variable | ||
| #904 | Zibal Payment Gateway for Gravity Forms | 27 | 828 | 248 | 400 | Text Domain Mismatch | ||
| #905 | Vertex Addons for Elementor | 28 | 232 | 413 | 400 | Output is not escaped | ||
| #906 | Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms | 28 | 632 | 351 | 800 | Text Domain Mismatch | ||
| #907 | Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms | 28 | 649 | 357 | 9k+ | Text Domain Mismatch | ||
| #908 | WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms | 28 | 659 | 359 | 400 | Text Domain Mismatch | ||
| #909 | Contact Form by BestWebSoft – Advanced WP Contact Form Builder for WordPress | 28 | 465 | 338 | 30k+ | Text Domain Mismatch | ||
| #910 | Expand Divi | 28 | 91 | 100 | 1k+ | Non-prefixed global variable | ||
| #911 | FAPI Member | 28 | 279 | 153 | 500 | Exception output is not escaped | ||
| #912 | Advanced Shipping Rates for WooCommerce: Flexible Table Rate Shipping Rules | 28 | 187 | 505 | 2k+ | Non-prefixed global variable | ||
| #913 | گیتلند | درگاه پرداخت هوشمند گیتلند | 28 | 327 | 235 | 3k+ | Output is not escaped | ||
| #914 | Photo Gallery – GT3 Image Gallery & Gutenberg Block Gallery | 28 | 384 | 175 | 10k+ | Text Domain Mismatch | ||
| #915 | Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms | 28 | 641 | 348 | 1k+ | Text Domain Mismatch | ||
| #916 | Kama Thumbnail | 28 | 80 | 47 | 9k+ | Output is not escaped | ||
| #917 | WP to LinkedIn Auto Publish | 28 | 734 | 250 | 900 | Unsafe printing function | ||
| #918 | Loginfy – Custom Login Page Customizer | 28 | 338 | 398 | 2k+ | Output is not escaped | ||
| #919 | MapSVG – Vector maps, Image maps, Google Maps | 28 | 79 | 49 | 1k+ | Missing direct file access protection | ||
| #920 | Media Hygiene: Remove or Delete Unused Images and More! | 28 | 654 | 309 | 5k+ | Non Singular String Literal Domain | ||
| #921 | درگاه پرداخت بانک ملت ووکامرس | 28 | 61 | 130 | 2k+ | Request data is not unslashed | ||
| #922 | My Sticky Bar – Floating Notification Bar & Sticky Header (formerly myStickymenu) | 28 | 164 | 441 | 100k+ | Non-prefixed global variable | ||
| #923 | ووکامرس فارسی | 28 | 157 | 215 | 90k+ | Output is not escaped | ||
| #924 | افزونه حمل و نقل ووکامرس | پست پیشتاز، تیپاکس و پیک موتوری | 28 | 131 | 190 | 20k+ | Missing nonce verification | ||
| #925 | Pixel Gallery Addons for Elementor – Easy Grid, Creative Gallery, Drag and Drop Grid, Custom Grid Layout, Portfolio Gallery | 28 | 146 | 259 | 5k+ | Post Not In exclude | ||
| #926 | Autopay | 28 | 769 | 334 | 3k+ | Text Domain Mismatch | ||
| #927 | Podcast Importer SecondLine | 28 | 356 | 169 | 4k+ | Text Domain Mismatch | ||
| #928 | Payment Plugins for PayPal WooCommerce | 28 | 232 | 246 | 80k+ | Non-prefixed hook name | ||
| #929 | Query Wrangler | 28 | 628 | 229 | 700 | Output is not escaped | ||
| #930 | Responsive Lightbox & Gallery | 28 | 139 | 513 | 100k+ | Non-prefixed hook name | ||
| #931 | Secure Downloads | 28 | 616 | 406 | 600 | Output is not escaped | ||
| #932 | Praison AI SEO | 28 | 649 | 306 | 1k+ | Text Domain Mismatch | ||
| #933 | Tab – Accordion, FAQ | 28 | 104 | 542 | 1k+ | Non-prefixed global variable | ||
| #934 | Temporary Login Without Password | 28 | 128 | 131 | 100k+ | wp function not compatible with requires wp | ||
| #935 | Terms descriptions | 28 | 222 | 423 | 1k+ | Non-prefixed function | ||
| #936 | Thim Kit for Elementor – Pre-built Templates & Widgets for Elementor | 28 | 291 | 292 | 20k+ | Output is not escaped | ||
| #937 | Jetpack VaultPress | 28 | 71 | 362 | 10k+ | Missing nonce verification | ||
| #938 | VG WORT METIS | 28 | 150 | 317 | 900 | Nonce verification recommended | ||
| #939 | WC Fields Factory | 28 | 194 | 369 | 7k+ | Nonce verification recommended | ||
| #940 | 10WebSocial | 28 | 584 | 185 | 10k+ | Unsafe printing function | ||
| #941 | PayZen for WooCommerce | 28 | 258 | 214 | 600 | Output is not escaped | ||
| #942 | WP Booking System – Booking Calendar | 28 | 502 | 549 | 20k+ | Output is not escaped | ||
| #943 | WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) | 28 | 209 | 217 | 10k+ | Exception output is not escaped | ||
| #944 | WPS Bidouille | 28 | 472 | 215 | 10k+ | Output is not escaped | ||
| #945 | Advanced coupon for WooCommerce | 29 | 472 | 242 | 900 | Text Domain Mismatch | ||
| #946 | AL Pack | 29 | 13 | 816 | 2k+ | Non-prefixed global variable | ||
| #947 | AppPresser – Mobile App Framework | 29 | 262 | 214 | 1k+ | Text Domain Mismatch | ||
| #948 | aThemeArt Theme Helper | 29 | 206 | 151 | 2k+ | Non-prefixed global variable | ||
| #949 | Better Google Analytics | 29 | 376 | 869 | 2k+ | Non-prefixed global variable | ||
| #950 | Bitcoin Payments – Blockonomics | 29 | 208 | 227 | 2k+ | Output is not escaped |
