WordPress.Security.SafeRedirect.wp_redirect_wp_redirect
wp redirect wp redirect
Plugin Check reported a security-sensitive coding pattern that needs review.
Why It Shows Up
The finding came from a security-focused WordPress coding standard or Plugin Check rule.
Why It Matters
Security findings often involve trust boundaries: request input, browser output, redirects, database access, capabilities, or filesystem behavior.
How to Fix
- Identify the untrusted value or privileged action involved.
- Add validation, sanitization, escaping, nonce checks, capability checks, or prepared SQL as appropriate.
- Rerun Plugin Check after the code path is fixed.
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #1901 | Migrate to WordPress.com | 62 | 15 | 28 | 2k+ | Output is not escaped | ||
| #1902 | Essential Addons for Elementor – Popular Elementor Templates & Widgets | 63 | 78 | 184 | 2m+ | wp function not compatible with requires wp | ||
| #1903 | FeedFocal | 63 | 16 | 6 | 2k+ | Unsafe printing function | ||
| #1904 | Simple Membership After Login Redirection | 63 | 4 | 24 | 10k+ | Missing nonce verification | ||
| #1905 | Review & testimonial widgets | 63 | 62 | 9 | 1k+ | Text Domain Mismatch | ||
| #1906 | PayPing Gateway For Woocommerce | 63 | 11 | 40 | 1k+ | Non-prefixed hook name | ||
| #1907 | Beautiful taxonomy filters | 64 | 38 | 78 | 2k+ | Non-prefixed global variable | ||
| #1908 | Channel.io | 64 | 14 | 3 | 1k+ | Output is not escaped | ||
| #1909 | Comment Blacklist Manager | 64 | 14 | 8 | 600 | Output is not escaped | ||
| #1910 | Dotdigital for WordPress | 64 | 41 | 123 | 400 | Dynamic hook name | ||
| #1911 | Easy Duplicate Woo Order | 64 | 17 | 10 | 1k+ | Unsafe printing function | ||
| #1912 | ELEX WooCommerce Product Price Custom Text (Before & After Text) and Discount | 64 | 444 | 137 | 2k+ | Missing Arg Domain | ||
| #1913 | Online Payments with iK Pay Gateway | 64 | 12 | 28 | 1k+ | Missing nonce verification | ||
| #1914 | Inactive Logout | 64 | 30 | 71 | 10k+ | Non-prefixed global variable | ||
| #1915 | Inline Related Posts | 64 | 17 | 39 | 100k+ | Nonce verification recommended | ||
| #1916 | Pageviews | 64 | 15 | 12 | 1k+ | Missing Translators Comment | ||
| #1917 | Stag Custom Sidebars | 64 | 10 | 12 | 2k+ | Text Domain Mismatch | ||
| #1918 | Contact Form 7 – Success Page Redirects | 65 | 5 | 15 | 10k+ | Input is not sanitized | ||
| #1919 | Cyr to Lat Reloaded – Transliteration of Links and File Names | 65 | 13 | 36 | 30k+ | Direct Query | ||
| #1920 | EDD Hide Download | 65 | 13 | 13 | 600 | Output is not escaped | ||
| #1921 | QR Code Composer – Automatic QR Code Generator | 65 | 33 | 2 | 3k+ | Output is not escaped | ||
| #1922 | Redirect 404 to Home Page – Custom URL | 65 | 7 | 11 | 4k+ | Output is not escaped | ||
| #1923 | Slider Revolution Search Replace | 65 | 5 | 14 | 900 | Input is not validated | ||
| #1924 | VK Link Target Controller | 65 | 13 | 10 | 30k+ | Output is not escaped | ||
| #1925 | AC Advanced Flamingo Settings | 66 | 6 | 32 | 700 | Nonce verification recommended | ||
| #1926 | FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration | 66 | 26 | 30 | 6k+ | Missing direct file access protection | ||
| #1927 | IranDargah Payment Gateway for Woocommerce | 66 | 66 | 26 | 400 | Text Domain Mismatch | ||
| #1928 | TAO Schedule Update | 66 | 37 | 11 | 2k+ | Text Domain Mismatch | ||
| #1929 | Raptive Ads | 67 | 34 | 31 | 6k+ | Text Domain Mismatch | ||
| #1930 | Smart Related Products – AI-Inspired Recommendations for WooCommerce | 67 | 13 | 15 | 1k+ | Output is not escaped | ||
| #1931 | Duplicate TEC Event | 67 | 12 | 10 | 900 | date date | ||
| #1932 | Flexible Product Fields (WooCommerce Product Addons) – WooCommerce Product Page Editor | 67 | 57 | 98 | 10k+ | Non-prefixed global variable | ||
| #1933 | Mailster Gmail Integration | 67 | 15 | 13 | 1k+ | Missing Translators Comment | ||
| #1934 | onOffice for WP-Websites | 67 | 5 | 507 | 1k+ | Non-prefixed global variable | ||
| #1935 | WP Forms + Sprout Invoices – Easy Invoice & Quote Submissions | 67 | 40 | 12 | 400 | Text Domain Mismatch | ||
| #1936 | BitPay Gateway for WooCommerce | 67 | 64 | 21 | 400 | Text Domain Mismatch | ||
| #1937 | JAMstack Deployments | 67 | 33 | 3 | 1k+ | Short PHP open tag found | ||
| #1938 | Controls for Contact Form 7 (Redirects, Analytics & Tracking) | 68 | 4 | 14 | 10k+ | Missing nonce verification | ||
| #1939 | ConvertBox Auto Embed WordPress plugin | 68 | 18 | 10 | 5k+ | Missing direct file access protection | ||
| #1940 | Featured Video for WooCommerce | 68 | 40 | 13 | 700 | Text Domain Mismatch | ||
| #1941 | Custom Form Builder, Contact Forms, Payment Forms, Surveys, Polls | 68 | 21 | 18 | 1k+ | Output is not escaped | ||
| #1942 | Thank You Page for WooCommerce | 68 | 6 | 27 | 10k+ | Non-prefixed global variable | ||
| #1943 | Age Gate | 69 | 61 | 139 | 40k+ | Missing direct file access protection | ||
| #1944 | WP Wand – Unlimited Content Generation using AI – for OpenAI, Claude, Openrouter and Deepseek | 69 | 452 | 25 | 1k+ | Text Domain Mismatch | ||
| #1945 | Chatway Live Chat – AI Chatbot, Customer Support, FAQ & Helpdesk Customer Service & Chat Buttons | 69 | 22 | 24 | 30k+ | Text Domain Mismatch | ||
| #1946 | Contact Form 7 | 69 | 56 | 39 | 10m+ | Missing direct file access protection | ||
| #1947 | Custom Login URL | 69 | 16 | 17 | 1k+ | Missing Arg Domain | ||
| #1948 | Disable Users | 69 | 11 | 9 | 2k+ | Text Domain Mismatch | ||
| #1949 | ELEX WooCommerce Bulk Edit Products, Prices & Attributes (Basic) | 69 | 511 | 51 | 4k+ | Text Domain Mismatch | ||
| #1950 | ELEX WooCommerce Discount Per Payment Method | 69 | 60 | 39 | 1k+ | Text Domain Mismatch |
