WordPress.WP.AlternativeFunctions.curl_curl_exec
curl curl exec
The plugin uses raw cURL functions instead of the WordPress HTTP API.
Why It Shows Up
Plugin Check found `curl_*` calls in plugin code.
Why It Matters
The WordPress HTTP API handles transports, proxies, SSL behavior, filters, and host compatibility more consistently than raw cURL.
How to Fix
- Replace simple cURL requests with `wp_remote_get()` or `wp_remote_post()`.
- Handle `WP_Error`, status codes, timeouts, and response body parsing explicitly.
- If a bundled library uses cURL internally, keep it isolated and avoid passing unchecked user input into requests.
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #151 | Fastcache by Host.it | 23 | 1,327 | 203 | 700 | Text Domain Mismatch | ||
| #152 | Feed Them Social – Social Media Feeds, Video, and Photo Galleries | 23 | 563 | 535 | 20k+ | Output is not escaped | ||
| #153 | Flexmls® IDX Plugin | 23 | 1,268 | 957 | 1k+ | Output is not escaped | ||
| #154 | Tracking and Consent Manager – WP Full Picture | 23 | 1,280 | 3,223 | 3k+ | Non-prefixed global variable | ||
| #155 | FV Flowplayer Video Player | 23 | 1,311 | 1,454 | 20k+ | Output is not escaped | ||
| #156 | GAinWP Google Analytics Integration for WordPress | 23 | 525 | 176 | 8k+ | Output is not escaped | ||
| #157 | Anti-Malware Security and Brute-Force Firewall | 23 | 543 | 965 | 100k+ | Output is not escaped | ||
| #158 | Houzez Property Feed | 23 | 1,464 | 1,615 | 1k+ | Text Domain Mismatch | ||
| #159 | Iks Menu – WordPress Category Accordion Menu & FAQs | 23 | 615 | 1,293 | 10k+ | Non-prefixed global variable | ||
| #160 | Import from YML | 23 | 97 | 308 | 400 | Non-prefixed global variable | ||
| #161 | RealHomes Memberships | 23 | 516 | 264 | 1k+ | Non Singular String Literal Domain | ||
| #162 | Kadence Blocks — Page Builder Toolkit for Gutenberg Editor | 23 | 55 | 2,127 | 600k+ | Non-prefixed global variable | ||
| #163 | Link Whisper Free | 23 | 3,882 | 5,303 | 30k+ | Text Domain Mismatch | ||
| #164 | Login With Ajax – Fast Logins, 2FA, Redirects | 23 | 623 | 520 | 10k+ | Output is not escaped | ||
| #165 | MasterStudy LMS WordPress Plugin – for Online Courses and Education | 23 | 1,419 | 4,875 | 10k+ | Non-prefixed global variable | ||
| #166 | Order Bump for WooCommerce | 23 | 1,720 | 1,562 | 600 | Output is not escaped | ||
| #167 | Restaurant Menu and Food Ordering | 23 | 385 | 853 | 2k+ | Non-prefixed global variable | ||
| #168 | MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar | 23 | 4,065 | 488 | 20k+ | Text Domain Mismatch | ||
| #169 | MStore API – Create Native Android & iOS Apps On The Cloud | 23 | 618 | 764 | 3k+ | SQL query is not prepared | ||
| #170 | MultiParcels Shipping For WooCommerce | 23 | 179 | 356 | 4k+ | Request data is not unslashed | ||
| #171 | MyWorks Sync for WooCommerce & QuickBooks Online | 23 | 2,292 | 9,101 | 5k+ | Non-prefixed global variable | ||
| #172 | Next Active Directory Integration | 23 | 683 | 284 | 2k+ | Exception output is not escaped | ||
| #173 | PayPal Brasil para WooCommerce | 23 | 554 | 328 | 1k+ | Unsafe printing function | ||
| #174 | Postie | 23 | 407 | 261 | 10k+ | Output is not escaped | ||
| #175 | PowerPress Podcasting plugin by Blubrry | 23 | 4,807 | 2,394 | 20k+ | Output is not escaped | ||
| #176 | Premium Addons for Elementor – Powerful Elementor Templates & Widgets | 23 | 206 | 997 | 700k+ | Non-prefixed hook name | ||
| #177 | Redirection | 23 | 523 | 457 | 100k+ | Non-prefixed global variable | ||
| #178 | Schema | 23 | 1,173 | 245 | 40k+ | Text Domain Mismatch | ||
| #179 | Seraphinite Post .DOCX Source | 23 | 1,156 | 110 | 900 | Output is not escaped | ||
| #180 | Shipment Tracker for Woocommerce | 23 | 462 | 559 | 2k+ | Missing Arg Domain | ||
| #181 | Simple URLs – Link Cloaking, Product Displays, and Affiliate Link Management | 23 | 295 | 298 | 4k+ | Non-prefixed global variable | ||
| #182 | Image Optimizer, Resizer and CDN – Sirv | 23 | 616 | 1,004 | 1k+ | Output is not escaped | ||
| #183 | Smart Marketing SMS and Newsletters Forms | 23 | 2,221 | 1,022 | 1k+ | Text Domain Mismatch | ||
| #184 | Smart Slider 3 | 23 | 261 | 268 | 800k+ | Non-prefixed global variable | ||
| #185 | Legal Terms and Conditions Popup for User Login and WooCommerce Checkout | 23 | 524 | 237 | 700 | Output is not escaped | ||
| #186 | Trinity Audio – Text to Speech AI audio player to convert content into audio | 23 | 119 | 227 | 2k+ | Non-prefixed global variable | ||
| #187 | Directory Listings WordPress plugin – uListing | 23 | 947 | 1,573 | 1k+ | Non-prefixed global variable | ||
| #188 | W3 Total Cache | 23 | 307 | 678 | 900k+ | Non-prefixed global variable | ||
| #189 | Cart PDF for WooCommerce | 23 | 531 | 172 | 1k+ | Exception output is not escaped | ||
| #190 | Peach Payments Gateway | 23 | 298 | 129 | 1k+ | Non Singular String Literal Domain | ||
| #191 | WHMCS Bridge | 23 | 247 | 472 | 4k+ | Nonce verification recommended | ||
| #192 | Billingo Plus integráció WooCommerce-hez | 23 | 1,119 | 507 | 900 | Text Domain Mismatch | ||
| #193 | PostFinance Checkout | 23 | 979 | 214 | 1k+ | Text Domain Mismatch | ||
| #194 | ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin | 23 | 7,423 | 2,181 | 90k+ | Text Domain Mismatch | ||
| #195 | Clone | 23 | 244 | 262 | 40k+ | Output is not escaped | ||
| #196 | WP Free SSL | 23 | 735 | 1,345 | 1k+ | Non-prefixed global variable | ||
| #197 | Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions | 23 | 1,123 | 1,860 | 9k+ | Output is not escaped | ||
| #198 | Lead Form Data Collection to CRM | 23 | 211 | 1,698 | 400 | Non-prefixed global variable | ||
| #199 | پارسی دیت – Parsi Date | 23 | 102 | 289 | 100k+ | Non-prefixed hook name | ||
| #200 | Subscribe Forms – Beautiful Email Forms, Embedded Newsletter Forms & MailChimp Form | 23 | 419 | 542 | 2k+ | Non-prefixed global variable |
