WordPress.WP.AlternativeFunctions.parse_url_parse_url
parse url parse url
The plugin uses raw URL parsing where WordPress URL helpers may be safer or more compatible.
Why It Shows Up
Plugin Check found `parse_url()` in plugin code.
Why It Matters
URL parsing is easy to get subtly wrong, especially with relative URLs, encoded values, and malformed input.
How to Fix
- Use WordPress helpers such as `wp_parse_url()`, `esc_url_raw()`, `esc_url()`, and `wp_http_validate_url()` where they fit.
- Validate schemes and hosts before using parsed URL parts.
- Do not use parsed URLs to build redirects or requests without allowlisting.
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #651 | NP Quote Request for WooCommerce | 40 | 91 | 145 | 9k+ | Non-prefixed global variable | ||
| #652 | WP Help | 40 | 49 | 54 | 10k+ | Unsafe printing function | ||
| #653 | Heroic Favicon Generator | 41 | 104 | 7 | 6k+ | Output is not escaped | ||
| #654 | Mihdan: Yandex Turbo Feed | 41 | 65 | 39 | 1k+ | Output is not escaped | ||
| #655 | Mobile Contact Bar | 41 | 94 | 36 | 10k+ | Unsafe printing function | ||
| #656 | Page Loading Effects | 41 | 68 | 24 | 2k+ | Output is not escaped | ||
| #657 | Responsive Plus – Elementor Templates & Starter Sites | 41 | 46 | 307 | 10k+ | Non-prefixed global variable | ||
| #658 | Simple 301 Redirects By BetterLinks – Easy WordPress Redirect Manager for Redirects, 404 Error Log & More | 41 | 43 | 61 | 100k+ | Request data is not unslashed | ||
| #659 | Simple Page Access Restriction | 41 | 66 | 51 | 6k+ | Unsafe printing function | ||
| #660 | Add to Home Screen & Progressive Web App | 42 | 23 | 68 | 1k+ | Request data is not unslashed | ||
| #661 | Clover Payments for WooCommerce | 42 | 25 | 15 | 2k+ | Exception output is not escaped | ||
| #662 | Rename wp-admin login | 42 | 23 | 38 | 8k+ | Output is not escaped | ||
| #663 | Simple Download Counter | 42 | 58 | 46 | 2k+ | Output is not escaped | ||
| #664 | Disable Gutenberg | 43 | 23 | 47 | 500k+ | Nonce verification recommended | ||
| #665 | GD bbPress Tools | 43 | 15 | 61 | 1k+ | Input is not sanitized | ||
| #666 | Event Tracking for Gravity Forms | 43 | 34 | 25 | 20k+ | rand mt rand | ||
| #667 | Post Carousel Slider for Elementor | 43 | 133 | 23 | 3k+ | Text Domain Mismatch | ||
| #668 | Theme Switcha – Easily Switch Themes for Development and Testing | 43 | 42 | 53 | 7k+ | Output is not escaped | ||
| #669 | Buttonizer – Live Chat, AI Chatbot, Call, Chat, Contact Button | 44 | 24 | 71 | 50k+ | Non-prefixed constant | ||
| #670 | Setmore Appointments | 44 | 45 | 13 | 4k+ | Output is not escaped | ||
| #671 | UiChemy — Figma Converter for Elementor, Gutenberg and Bricks | 44 | 7 | 85 | 9k+ | Nonce verification recommended | ||
| #672 | Hyper Cache | 45 | 36 | 100 | 8k+ | Non-prefixed global variable | ||
| #673 | LWS Hide Login | 45 | 5 | 58 | 20k+ | Request data is not unslashed | ||
| #674 | reCAPTCHA for Asgaros Forum | 45 | 21 | 36 | 4k+ | Input is not validated | ||
| #675 | CLP Varnish Cache | 46 | 15 | 58 | 10k+ | Non-prefixed global variable | ||
| #676 | Link in Bio Creator – Social | 46 | 52 | 36 | 2k+ | Non Singular String Literal Domain | ||
| #677 | 3CX Free Live Chat, Calls & Messaging | 46 | 24 | 16 | 100k+ | Output is not escaped | ||
| #678 | Flying Pages: Preload Pages for Faster Navigation & Improved User Experience | 47 | 21 | 21 | 20k+ | Missing direct file access protection | ||
| #679 | Tabby Checkout | 47 | 33 | 46 | 4k+ | Non-prefixed class | ||
| #680 | XML Sitemap & Google News | 47 | 270 | 224 | 100k+ | Non-prefixed global variable | ||
| #681 | Ansar Import – One Click Starter Sites – for Elementor & Themes | 48 | 27 | 116 | 20k+ | Non-prefixed global variable | ||
| #682 | ACF Quick Edit Fields | 49 | 20 | 72 | 30k+ | Nonce verification recommended | ||
| #683 | Secondary Product Image for WooCommerce | 49 | 25 | 29 | 2k+ | Output is not escaped | ||
| #684 | SpinupWP | 49 | 43 | 38 | 30k+ | Non-prefixed function | ||
| #685 | TrustedSite | 50 | 29 | 14 | 20k+ | Output is not escaped | ||
| #686 | Gravatar Enhanced – Avatars, Profiles, and Privacy | 51 | 38 | 48 | 100k+ | Dynamic hook name | ||
| #687 | Trustpilot Reviews | 51 | 14 | 52 | 30k+ | Missing nonce verification | ||
| #688 | GSheetConnector for Gravity Forms – Send Gravity Forms Entries to Google Sheets in Real-Time | 52 | 26 | 27 | 1k+ | Exception output is not escaped | ||
| #689 | Podium | 52 | 21 | 23 | 5k+ | Missing direct file access protection | ||
| #690 | Multiple Post Thumbnails | 53 | 25 | 18 | 20k+ | Output is not escaped | ||
| #691 | Pinterest for WooCommerce | 53 | 44 | 30 | 300k+ | Exception output is not escaped | ||
| #692 | WP User Switch | 53 | 8 | 46 | 1k+ | Input is not sanitized | ||
| #693 | Disqus Comment System | 54 | 17 | 33 | 40k+ | Non-prefixed hook name | ||
| #694 | Gutenify – Visual Site Builder Blocks & Site Templates | 55 | 66 | 40 | 5k+ | Missing Arg Domain | ||
| #695 | Hide Admin Menu | 55 | 18 | 27 | 20k+ | Non-prefixed function | ||
| #696 | Marvy – Background Animations for Elementor | 55 | 63 | 34 | 4k+ | Text Domain Mismatch | ||
| #697 | WP Ultimate Review | 55 | 23 | 381 | 70k+ | Non-prefixed global variable | ||
| #698 | Debloat – Remove Unused CSS, Optimize JS | 58 | 24 | 20 | 30k+ | Nonce verification recommended | ||
| #699 | Videopack | 58 | 28 | 108 | 10k+ | Input is not sanitized | ||
| #700 | Cloak Affiliate Links for WooCommerce | 58 | 28 | 6 | 2k+ | Non Singular String Literal Domain |
