WordPress.WP.AlternativeFunctions.curl_curl_init
curl curl init
The plugin uses raw cURL functions instead of the WordPress HTTP API.
Why It Shows Up
Plugin Check found `curl_*` calls in plugin code.
Why It Matters
The WordPress HTTP API handles transports, proxies, SSL behavior, filters, and host compatibility more consistently than raw cURL.
How to Fix
- Replace simple cURL requests with `wp_remote_get()` or `wp_remote_post()`.
- Handle `WP_Error`, status codes, timeouts, and response body parsing explicitly.
- If a bundled library uses cURL internally, keep it isolated and avoid passing unchecked user input into requests.
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #401 | PayZen for WooCommerce | 28 | 258 | 214 | 600 | Output is not escaped | ||
| #402 | WP Mapbox GL JS Maps | 28 | 104 | 119 | 1k+ | Output is not escaped | ||
| #403 | Connect Matomo – Analytics Dashboard for WordPress | 28 | 100 | 102 | 60k+ | Missing Translators Comment | ||
| #404 | WhyDonate – FREE Donate button – Crowdfunding – Fundraising | 28 | 216 | 328 | 800 | Non-prefixed global variable | ||
| #405 | WP YouTube Lyte | 28 | 204 | 178 | 30k+ | Non-prefixed global variable | ||
| #406 | WPify Woo – Withdrawal, CRN/VAT, QR payments, Heureka and more for WooCommerce | 28 | 177 | 226 | 5k+ | Output is not escaped | ||
| #407 | WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) | 28 | 209 | 217 | 10k+ | Exception output is not escaped | ||
| #408 | WxSync-标准云微信公众号文章免费采集-任意公众号自动采集付费购买 | 28 | 57 | 138 | 500 | Request data is not unslashed | ||
| #409 | WPCS – WordPress Currency Switcher Professional | 29 | 84 | 358 | 900 | Non-prefixed global variable | ||
| #410 | Display Tweets | 29 | 135 | 135 | 900 | Non-prefixed global variable | ||
| #411 | Document Gallery | 29 | 183 | 98 | 8k+ | Output is not escaped | ||
| #412 | FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider | 29 | 74 | 78 | 600k+ | Missing Translators Comment | ||
| #413 | Getwid – Gutenberg Blocks | 29 | 139 | 173 | 50k+ | Non-prefixed global variable | ||
| #414 | Gianism | 29 | 391 | 154 | 700 | Text Domain Mismatch | ||
| #415 | Easy HTTPS Redirection (SSL) | 29 | 266 | 152 | 100k+ | Unsafe printing function | ||
| #416 | Laposta WooCommerce | 29 | 96 | 115 | 500 | Non-prefixed global variable | ||
| #417 | Offload Media – Cloud Storage | 29 | 126 | 80 | 1k+ | unlink unlink | ||
| #418 | PhastPress | 29 | 95 | 52 | 10k+ | Exception output is not escaped | ||
| #419 | PlatiOnline Payments | 29 | 304 | 110 | 700 | Output is not escaped | ||
| #420 | Responder | 29 | 77 | 185 | 3k+ | Non-prefixed global variable | ||
| #421 | SamedayCourier Shipping | 29 | 336 | 269 | 4k+ | Non Singular String Literal Domain | ||
| #422 | Tilda-publishing | 29 | 219 | 78 | 700 | Output is not escaped | ||
| #423 | Wenprise Alipay Gateway For WooCommerce | 29 | 113 | 68 | 700 | Exception output is not escaped | ||
| #424 | Widget for Yelp Reviews | 29 | 147 | 158 | 2k+ | Output is not escaped | ||
| #425 | Sofortueberweisung Gateway for Woocommerce | 29 | 104 | 71 | 700 | Output is not escaped | ||
| #426 | WP Subscribe | 29 | 79 | 79 | 8k+ | Non-prefixed class | ||
| #427 | BrightEdge Autopilot | 30 | 108 | 31 | 500 | curl curl setopt | ||
| #428 | ContentBot AI Writer (AI Content) | 30 | 317 | 69 | 500 | rand rand | ||
| #429 | Formzu WP | 30 | 167 | 163 | 3k+ | Text Domain Mismatch | ||
| #430 | GlobalPayments Gateway Provider for WooCommerce | 30 | 611 | 170 | 1k+ | Text Domain Mismatch | ||
| #431 | Laposta Signup Embed | 30 | 88 | 19 | 1k+ | Exception output is not escaped | ||
| #432 | Midtrans-WooCommerce | 30 | 112 | 132 | 5k+ | Non-prefixed global variable | ||
| #433 | Naver webmaster syndication v2 | 30 | 89 | 129 | 500 | Output is not escaped | ||
| #434 | Operation Demo Importer – Demo Importer For WPoperation Themes | 30 | 245 | 104 | 1k+ | Text Domain Mismatch | ||
| #435 | گرویتی فرم فارسی | 30 | 205 | 157 | 20k+ | Text Domain Mismatch | ||
| #436 | WonderPush – Web Push Notifications – WooCommerce Abandoned Cart – GDPR | 30 | 152 | 192 | 600 | Missing direct file access protection | ||
| #437 | zahls.ch Credit Cards, PostFinance and TWINT for WooCommerce | 30 | 121 | 265 | 3k+ | Non-prefixed global variable | ||
| #438 | Buy Me a Coffee – Button and Widget Plugin | 31 | 138 | 140 | 6k+ | Output is not escaped | ||
| #439 | CashBill.pl – Płatności WooCommerce | 31 | 181 | 101 | 900 | Output is not escaped | ||
| #440 | Newsletter Sign-Up for CleverReach | 31 | 174 | 72 | 2k+ | Output is not escaped | ||
| #441 | FraudLabs Pro for WooCommerce | 31 | 169 | 213 | 1k+ | Request data is not unslashed | ||
| #442 | g-FFL Checkout | 31 | 249 | 300 | 600 | Request data is not unslashed | ||
| #443 | Gabfire Widget Pack | 31 | 1,041 | 60 | 600 | Output is not escaped | ||
| #444 | HT Easy GA4 – Google Analytics WordPress Plugin | 31 | 475 | 93 | 6k+ | Text Domain Mismatch | ||
| #445 | Linguise – AI Automatic Multilingual Translation | 31 | 61 | 284 | 1k+ | Non-prefixed global variable | ||
| #446 | Openpay Cards Plugin | 31 | 166 | 105 | 3k+ | Text Domain Mismatch | ||
| #447 | PanoPress | 31 | 111 | 234 | 2k+ | Output is not escaped | ||
| #448 | PayKeeper Payment Gateway for WooCommerce | 31 | 113 | 44 | 400 | Non Singular String Literal Domain | ||
| #449 | افزونه پیامک ووکامرس Persian WooCommerce SMS | 31 | 72 | 269 | 40k+ | Nonce verification recommended | ||
| #450 | Pop-up | 31 | 103 | 91 | 10k+ | Output is not escaped |
