WordPress.Security.SafeRedirect.wp_redirect_wp_redirect
wp redirect wp redirect
Plugin Check reported a security-sensitive coding pattern that needs review.
Why It Shows Up
The finding came from a security-focused WordPress coding standard or Plugin Check rule.
Why It Matters
Security findings often involve trust boundaries: request input, browser output, redirects, database access, capabilities, or filesystem behavior.
How to Fix
- Identify the untrusted value or privileged action involved.
- Add validation, sanitization, escaping, nonce checks, capability checks, or prepared SQL as appropriate.
- Rerun Plugin Check after the code path is fixed.
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #1651 | turboSMTP | 40 | 114 | 112 | 400 | Unsafe printing function | ||
| #1652 | Ultimate Dashboard – Custom WordPress Dashboard | 40 | 17 | 144 | 60k+ | Input is not sanitized | ||
| #1653 | Universal Honey Pot | 40 | 23 | 94 | 1k+ | Missing nonce verification | ||
| #1654 | Visma Pay for Woocommerce | 40 | 27 | 37 | 2k+ | Output is not escaped | ||
| #1655 | Weight Based Pricing for WooCommerce | 40 | 167 | 86 | 600 | Text Domain Mismatch | ||
| #1656 | Eurobank WooCommerce Payment Gateway | 40 | 66 | 43 | 2k+ | Non Singular String Literal Domain | ||
| #1657 | Additional Variation Images Gallery for WooCommerce | 40 | 60 | 129 | 20k+ | Non-prefixed global variable | ||
| #1658 | WP Compress for MainWP | 40 | 20 | 36 | 700 | Output is not escaped | ||
| #1659 | Easy PayPal & Stripe Buy Now Button | 40 | 388 | 96 | 10k+ | Unsafe printing function | ||
| #1660 | WP Reroute Email | 40 | 141 | 106 | 1k+ | Output is not escaped | ||
| #1661 | WPFront Notification Bar | 40 | 222 | 44 | 50k+ | Output is not escaped | ||
| #1662 | Yektanet Ecommerce | 40 | 45 | 103 | 1k+ | Request data is not unslashed | ||
| #1663 | AMP for WP – Accelerated Mobile Pages | 41 | 656 | 2,401 | 80k+ | Non-prefixed global variable | ||
| #1664 | Ad Auto Insert H | 41 | 496 | 15 | 1k+ | Non Singular String Literal Domain | ||
| #1665 | Advanced Excerpt | 41 | 69 | 43 | 70k+ | Unsafe printing function | ||
| #1666 | Age Verify | 41 | 29 | 31 | 1k+ | Output is not escaped | ||
| #1667 | Antispam | 41 | 11 | 41 | 400 | Missing nonce verification | ||
| #1668 | Authenticator | 41 | 59 | 44 | 1k+ | Output is not escaped | ||
| #1669 | Auto Image Attributes From Filename With Bulk Updater (Add Alt Text, Image Title For Image SEO) | 41 | 175 | 26 | 100k+ | Unsafe printing function | ||
| #1670 | Autocomplete Google Address | 41 | 22 | 67 | 2k+ | Nonce verification recommended | ||
| #1671 | Avatar Manager | 41 | 29 | 41 | 5k+ | Unsafe printing function | ||
| #1672 | BuddyPress Edit Activity | 41 | 28 | 26 | 800 | Output is not escaped | ||
| #1673 | Bulk Delete Comments | 41 | 15 | 61 | 5k+ | Direct Query | ||
| #1674 | Carbon Copy | 41 | 64 | 89 | 3k+ | Text Domain Mismatch | ||
| #1675 | Easy Social Like Box – Popup – Sidebar Widget | 41 | 217 | 91 | 7k+ | Text Domain Mismatch | ||
| #1676 | CloudGuard | 41 | 41 | 13 | 1k+ | Output is not escaped | ||
| #1677 | CMS Tree Page View – Reorder Pages with a Drag-and-Drop Tree | 41 | 121 | 96 | 50k+ | Unsafe printing function | ||
| #1678 | Controlled Admin Access | 41 | 22 | 40 | 10k+ | Nonce verification recommended | ||
| #1679 | Disable Everything | 41 | 90 | 16 | 30k+ | Output is not escaped | ||
| #1680 | Duplicate Page and Post | 41 | 26 | 21 | 80k+ | Unsafe printing function | ||
| #1681 | Edit Lock | 41 | 47 | 22 | 500 | Non Singular String Literal Domain | ||
| #1682 | Payment Gateway of PayPal for WooCommerce | 41 | 44 | 184 | 7k+ | Nonce verification recommended | ||
| #1683 | Gallery Lightbox | 41 | 47 | 16 | 10k+ | Output is not escaped | ||
| #1684 | Google Authenticator | 41 | 39 | 65 | 20k+ | Output is not escaped | ||
| #1685 | Hide WP Admin Login | 41 | 23 | 39 | 500 | Nonce verification recommended | ||
| #1686 | iCount Payment Gateway | 41 | 152 | 22 | 500 | Text Domain Mismatch | ||
| #1687 | Central Color Palette | 41 | 73 | 33 | 10k+ | Output is not escaped | ||
| #1688 | Mollie Forms | 41 | 14 | 565 | 3k+ | Request data is not unslashed | ||
| #1689 | Multiple Domain | 41 | 42 | 17 | 10k+ | Output is not escaped | ||
| #1690 | My Wp Brand – Hide menu & Hide Plugin | 41 | 74 | 50 | 2k+ | Non Singular String Literal Domain | ||
| #1691 | Social Login | 41 | 8 | 110 | 5k+ | Input is not sanitized | ||
| #1692 | Live Chat & AI Chatbot – onWebChat | 41 | 31 | 91 | 700 | error log error log | ||
| #1693 | Optimus – WordPress Image Optimizer | 41 | 52 | 20 | 30k+ | Unsafe printing function | ||
| #1694 | Passwordless Login | 41 | 40 | 24 | 1k+ | Output is not escaped | ||
| #1695 | Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News | 41 | 537 | 20k+ | Non-prefixed global variable | |||
| #1696 | Post Cloner | 41 | 25 | 15 | 1k+ | Text Domain Mismatch | ||
| #1697 | wpSUBpages Redirect | 41 | 24 | 27 | 600 | Output is not escaped | ||
| #1698 | Revisionize | 41 | 54 | 24 | 4k+ | Output is not escaped | ||
| #1699 | IP Ban | 41 | 29 | 39 | 2k+ | Input is not validated | ||
| #1700 | Simple Page Access Restriction | 41 | 66 | 51 | 6k+ | Unsafe printing function |
