WordPress.WP.AlternativeFunctions.curl_curl_setopt
curl curl setopt
The plugin uses raw cURL functions instead of the WordPress HTTP API.
Why It Shows Up
Plugin Check found `curl_*` calls in plugin code.
Why It Matters
The WordPress HTTP API handles transports, proxies, SSL behavior, filters, and host compatibility more consistently than raw cURL.
How to Fix
- Replace simple cURL requests with `wp_remote_get()` or `wp_remote_post()`.
- Handle `WP_Error`, status codes, timeouts, and response body parsing explicitly.
- If a bundled library uses cURL internally, keep it isolated and avoid passing unchecked user input into requests.
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #251 | Payment Gateway for PayPal on WooCommerce | 24 | 153 | 561 | 10k+ | Nonce verification recommended | ||
| #252 | pensopay Payments | 24 | 396 | 246 | 2k+ | Output is not escaped | ||
| #253 | wallee | 24 | 331 | 220 | 400 | Exception output is not escaped | ||
| #254 | EU VAT Assistant for WooCommerce | 24 | 1,742 | 495 | 5k+ | Non Singular String Literal Domain | ||
| #255 | European VAT Compliance Assistant for WooCommerce | 24 | 515 | 317 | 3k+ | Output is not escaped | ||
| #256 | AI ChatBot for eCommerce – WoowBot | 24 | 145 | 528 | 900 | Request data is not unslashed | ||
| #257 | WP Admin Audit | 24 | 1,051 | 781 | 1k+ | error log print r | ||
| #258 | WP-Appbox | 24 | 418 | 390 | 2k+ | Missing Arg Domain | ||
| #259 | WP Helper Premium | 24 | 3,908 | 1,515 | 1k+ | Text Domain Mismatch | ||
| #260 | پارسی دیت – Parsi Date | 24 | 106 | 291 | 100k+ | Non-prefixed hook name | ||
| #261 | WP RSS Aggregator – RSS Import, Feed to Post, Autoblogging, AI Content | 24 | 1,777 | 394 | 40k+ | Text Domain Mismatch | ||
| #262 | WP Travel – Ultimate Travel Booking System, Tour Management Engine | 24 | 227 | 1,962 | 4k+ | Non-prefixed hook name | ||
| #263 | WP Travel Engine – Tour Booking Plugin – Tour Operator Software | 24 | 2,010 | 5,688 | 20k+ | Non-prefixed global variable | ||
| #264 | WPSpeed – WordPress Speed, Cache & Performance Optimization (Core Web Vitals, PageSpeed 100) | 24 | 482 | 189 | 2k+ | Output is not escaped | ||
| #265 | WpStream – Live Streaming, Video on Demand, Pay Per View | 24 | 1,724 | 742 | 3k+ | Text Domain Mismatch | ||
| #266 | Booking for Appointments and Events Calendar – Amelia | 25 | 1,487 | 480 | 90k+ | Exception output is not escaped | ||
| #267 | Appointment Booking Calendar | 25 | 327 | 1,055 | 1k+ | Non-prefixed global variable | ||
| #268 | Beaver Builder Page Builder – Drag and Drop Website Builder | 25 | 4,463 | 1,819 | 100k+ | Text Domain Mismatch | ||
| #269 | Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid | 25 | 243 | 854 | 50k+ | Non-prefixed global variable | ||
| #270 | Booking Calendar Contact Form | 25 | 371 | 884 | 500 | Input is not validated | ||
| #271 | Booking Package | 25 | 1,703 | 3,977 | 10k+ | Missing nonce verification | ||
| #272 | Breeze Cache | 25 | 218 | 800 | 400k+ | Non-prefixed global variable | ||
| #273 | Broken Link Checker | 25 | 727 | 600 | 500k+ | Output is not escaped | ||
| #274 | CheckoutWC Lite | 25 | 1,399 | 852 | 3k+ | Text Domain Mismatch | ||
| #275 | HIPAA FORMS | 25 | 414 | 416 | 800 | Request data is not unslashed | ||
| #276 | Colissimo shipping methods for WooCommerce | 25 | 1,755 | 557 | 10k+ | Text Domain Mismatch | ||
| #277 | CP Contact Form with PayPal | 25 | 466 | 936 | 800 | Unsafe printing function | ||
| #278 | DecaLog | 25 | 943 | 236 | 1k+ | Exception output is not escaped | ||
| #279 | Demo Importer Plus | 25 | 58 | 239 | 10k+ | Non-prefixed hook name | ||
| #280 | WEB-Translation – eTranslation Multilingual | 25 | 217 | 1,057 | 400 | Non-prefixed function | ||
| #281 | Events Made Easy | 25 | 506 | 6,317 | 1k+ | Non-prefixed function | ||
| #282 | Site Kit by Google – Analytics, Search Console, AdSense, Speed | 25 | 1,304 | 242 | 5m+ | Missing direct file access protection | ||
| #283 | Sitemap by BestWebSoft – WordPress XML Site Map Page Generator Plugin | 25 | 608 | 207 | 20k+ | Text Domain Mismatch | ||
| #284 | Hydra Booking — Appointment Scheduling & Booking Calendar | 25 | 238 | 707 | 2k+ | Non-prefixed global variable | ||
| #285 | Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more | 25 | 4,019 | 1,265 | 2k+ | Text Domain Mismatch | ||
| #286 | Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force Prevention | 25 | 617 | 614 | 1m+ | Unsafe printing function | ||
| #287 | Loginizer | 25 | 814 | 504 | 1m+ | Output is not escaped | ||
| #288 | LWS Optimize – All-in-One Speed Booster & Cache Tools | 25 | 430 | 764 | 20k+ | Non-prefixed global variable | ||
| #289 | Media Cloud Sync | 25 | 1,095 | 274 | 1k+ | Exception output is not escaped | ||
| #290 | Multibanco / MB Way / Payshop / Cofidis Pay (by LUSOPAY) for WooCommerce | 25 | 492 | 216 | 400 | Text Domain Mismatch | ||
| #291 | Object Sync for Salesforce | 25 | 192 | 296 | 500 | Non-prefixed global variable | ||
| #292 | PDF & Print by BestWebSoft – WordPress Posts and Pages PDF Generator Plugin | 25 | 1,084 | 1,296 | 9k+ | Non-prefixed global variable | ||
| #293 | Quttera ThreatSign – Web Malware Scanner for WordPress | 25 | 334 | 471 | 10k+ | Non-prefixed global variable | ||
| #294 | reSmush.it : The original free image compressor and optimizer plugin | 25 | 155 | 69 | 100k+ | Output is not escaped | ||
| #295 | BerqWP – All-In-One Optimization for Core Web Vitals, Cache, CDN, Images, CSS & JavaScript | 25 | 198 | 501 | 4k+ | Non-prefixed global variable | ||
| #296 | ShopMagic – email automation | 25 | 228 | 145 | 10k+ | Exception output is not escaped | ||
| #297 | Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin | 25 | 960 | 738 | 60k+ | Text Domain Mismatch | ||
| #298 | Tamara Checkout | 25 | 601 | 228 | 2k+ | Exception output is not escaped | ||
| #299 | Social Share Icons & Social Share Buttons | 25 | 2,365 | 1,357 | 10k+ | Output is not escaped | ||
| #300 | VikAppointments Services Booking Calendar | 25 | 9,753 | 5,207 | 500 | Output is not escaped |
