WordPress.Security.SafeRedirect.wp_redirect_wp_redirect
wp redirect wp redirect
Plugin Check reported a security-sensitive coding pattern that needs review.
Why It Shows Up
The finding came from a security-focused WordPress coding standard or Plugin Check rule.
Why It Matters
Security findings often involve trust boundaries: request input, browser output, redirects, database access, capabilities, or filesystem behavior.
How to Fix
- Identify the untrusted value or privileged action involved.
- Add validation, sanitization, escaping, nonce checks, capability checks, or prepared SQL as appropriate.
- Rerun Plugin Check after the code path is fixed.
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #1501 | Audio Story Images | 38 | 46 | 44 | 400 | Output is not escaped | ||
| #1502 | Autologin Links | 38 | 73 | 74 | 8k+ | Output is not escaped | ||
| #1503 | Bot Block – Stop Spam Referrals in Google Analytics | 38 | 28 | 42 | 600 | Output is not escaped | ||
| #1504 | Classic Editor Plus – WordPress Classic Editor plugin by Felix | 38 | 83 | 42 | 500 | Text Domain Mismatch | ||
| #1505 | Clever Mega Menu for Visual Composer | 38 | 500 | 87 | 1k+ | Output is not escaped | ||
| #1506 | Clever Mega Menu for Elementor | 38 | 835 | 44 | 1k+ | Output is not escaped | ||
| #1507 | Chatbot for WordPress by Collect.chat ⚡️ | 38 | 58 | 36 | 6k+ | Unsafe printing function | ||
| #1508 | country-redirect | 38 | 58 | 19 | 400 | Text Domain Mismatch | ||
| #1509 | One page checkout and layouts for woocommerce | 38 | 83 | 52 | 3k+ | Non-prefixed global variable | ||
| #1510 | Login Page Customizer – Customize Login Screen & Branding | 38 | 36 | 172 | 1k+ | Non-prefixed function | ||
| #1511 | Darkify – Dark Mode & Night Mode for Website & Admin (Dark Theme Included) | 38 | 38 | 183 | 600 | Non-prefixed global variable | ||
| #1512 | PiWeb Product Enquiry or product catalog for WooCommerce | 38 | 255 | 145 | 1k+ | Text Domain Mismatch | ||
| #1513 | EU Cookie Law Compliance | 38 | 151 | 22 | 2k+ | Non Singular String Literal Domain | ||
| #1514 | Export User Data | 38 | 187 | 62 | 6k+ | Text Domain Mismatch | ||
| #1515 | Buttonizer – Social Media Share Buttons, Social Icons, & Social Feeds | 38 | 167 | 82 | 50k+ | Output is not escaped | ||
| #1516 | Front-end Editor | 38 | 78 | 62 | 500 | Output is not escaped | ||
| #1517 | Furgonetka.pl: Przesyłki & Narzędzia e-commerce | 38 | 63 | 48 | 7k+ | Exception output is not escaped | ||
| #1518 | Goal Tracker – Custom Event Tracking for GA4 | 38 | 541 | 25 | 2k+ | Output is not escaped | ||
| #1519 | Greek Multi Tool – Greeklish Slugs, Permalinks & Transliteration | 38 | 160 | 82 | 1k+ | Unsafe printing function | ||
| #1520 | CAOS | Host Google Analytics Locally | 38 | 124 | 44 | 10k+ | Output is not escaped | ||
| #1521 | Jock On Air Now (JOAN) | 38 | 121 | 224 | 400 | Output is not escaped | ||
| #1522 | Kali Forms — Contact Form & Drag-and-Drop Builder | 38 | 3 | 252 | 10k+ | Dynamic hook name | ||
| #1523 | Lana Downloads Manager | 38 | 146 | 78 | 3k+ | Unsafe printing function | ||
| #1524 | Group chat for WordPress – Minnit Chat | 38 | 39 | 65 | 500 | Non-prefixed global variable | ||
| #1525 | Monetag Official Plugin | 38 | 133 | 32 | 5k+ | Text Domain Mismatch | ||
| #1526 | OneSignal – Web Push Notifications | 38 | 53 | 64 | 70k+ | Output is not escaped | ||
| #1527 | Page Links To | 38 | 31 | 40 | 100k+ | Unsafe printing function | ||
| #1528 | Podlove Subscribe button | 38 | 148 | 45 | 2k+ | Output is not escaped | ||
| #1529 | Quick Download Button | 38 | 34 | 123 | 2k+ | Non-prefixed global variable | ||
| #1530 | WP REST API – OAuth 1.0a Server | 38 | 100 | 85 | 8k+ | Text Domain Mismatch | ||
| #1531 | LinkBoss – Semantic AI Internal Linking | 38 | 28 | 57 | 2k+ | Missing Arg Domain | ||
| #1532 | Simple JWT Login – Allows you to use JWT on REST endpoints. | 38 | 712 | 95 | 4k+ | Output is not escaped | ||
| #1533 | Simple Keyword to Link | 38 | 90 | 49 | 3k+ | Non Singular String Literal Domain | ||
| #1534 | SimpleShop | 38 | 52 | 51 | 1k+ | date date | ||
| #1535 | Slickplan Importer | 38 | 40 | 58 | 400 | Non-prefixed global variable | ||
| #1536 | Stock Market News | 38 | 71 | 11 | 500 | Output is not escaped | ||
| #1537 | Stock Market Overview | 38 | 86 | 14 | 1k+ | Output is not escaped | ||
| #1538 | Stock Market Ticker | 38 | 69 | 14 | 3k+ | Output is not escaped | ||
| #1539 | Stock Quotes List | 38 | 72 | 13 | 600 | Output is not escaped | ||
| #1540 | Logo Slider , Logo Carousel , Logo showcase , Client Logo | 38 | 72 | 22 | 1k+ | Output is not escaped | ||
| #1541 | Templatiq | 38 | 31 | 94 | 900 | Non-prefixed hook name | ||
| #1542 | Variation Swatches for WooCommerce | 38 | 45 | 65 | 2k+ | Output is not escaped | ||
| #1543 | Trackserver | 38 | 17 | 356 | 400 | Input is not sanitized | ||
| #1544 | Trash Duplicate and 301 Redirect | 38 | 13 | 103 | 1k+ | Nonce verification recommended | ||
| #1545 | Sidebar Login Widget | 38 | 90 | 16 | 700 | Output is not escaped | ||
| #1546 | Unconfirmed | 38 | 20 | 79 | 1k+ | Nonce verification recommended | ||
| #1547 | TWIPLA (Visitor Analytics IO) – Privacy-First Website Stats, Session Recordings, Heatmaps, Polls and Surveys | 38 | 71 | 49 | 900 | Output is not escaped | ||
| #1548 | Chatbox Manager | 38 | 855 | 78 | 400 | Output is not escaped | ||
| #1549 | SSLCommerz Payment Gateway | 38 | 21 | 132 | 2k+ | Non-prefixed global variable | ||
| #1550 | WholesaleX – B2B & Wholesale Plugin for WooCommerce with Wholesale Prices | 38 | 33 | 181 | 2k+ | Non-prefixed global variable |
