WordPress.WP.AlternativeFunctions.parse_url_parse_url
parse url parse url
The plugin uses raw URL parsing where WordPress URL helpers may be safer or more compatible.
Why It Shows Up
Plugin Check found `parse_url()` in plugin code.
Why It Matters
URL parsing is easy to get subtly wrong, especially with relative URLs, encoded values, and malformed input.
How to Fix
- Use WordPress helpers such as `wp_parse_url()`, `esc_url_raw()`, `esc_url()`, and `wp_http_validate_url()` where they fit.
- Validate schemes and hosts before using parsed URL parts.
- Do not use parsed URLs to build redirects or requests without allowlisting.
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #851 | Gmail SMTP | 37 | 85 | 71 | 10k+ | Unsafe printing function | ||
| #852 | GoCache | 37 | 273 | 43 | 900 | Non Singular String Literal Domain | ||
| #853 | XML Sitemap Generator for Google | 37 | 43 | 79 | 1m+ | Input is not validated | ||
| #854 | Language Switcher | 37 | 81 | 105 | 1k+ | Missing Translators Comment | ||
| #855 | MailingBoss WP Plugin | 37 | 108 | 30 | 600 | Output is not escaped | ||
| #856 | Media Sweep – WordPress Media Cleaner | 37 | 56 | 137 | 1k+ | Interpolated SQL is not prepared | ||
| #857 | CrawlWP SEO – Instant Search Engine Indexing & SEO Performance Monitor | 37 | 47 | 90 | 40k+ | Dynamic hook name | ||
| #858 | Nearby Now Reviews and Audio Testimonials | 37 | 66 | 67 | 1k+ | wp function not compatible with requires wp | ||
| #859 | Ninja Van (MY) | 37 | 21 | 258 | 1k+ | Non-prefixed global variable | ||
| #860 | Recent Posts Widget With Thumbnails | 37 | 222 | 46 | 100k+ | Output is not escaped | ||
| #861 | SendWP | 37 | 47 | 42 | 10k+ | Output is not escaped | ||
| #862 | Skimlinks Affiliate Marketing Tool | 37 | 84 | 19 | 800 | wp function not compatible with requires wp | ||
| #863 | Smart Send Logistics | 37 | 92 | 81 | 400 | Output is not escaped | ||
| #864 | Spam Destroyer | 37 | 63 | 43 | 6k+ | rand rand | ||
| #865 | Tourfic Toolkit | 37 | 67 | 165 | 1k+ | Post Not In exclude | ||
| #866 | Widget Box Lite | 37 | 318 | 17 | 900 | Output is not escaped | ||
| #867 | FundEngine – Donation and Crowdfunding Platform | 37 | 90 | 9 | 1k+ | Exception output is not escaped | ||
| #868 | WP Flow Plus | 37 | 175 | 146 | 800 | Output is not escaped | ||
| #869 | Add Customer for WooCommerce | 38 | 229 | 153 | 1k+ | Text Domain Mismatch | ||
| #870 | Admin Bar & Dashboard Access Control | 38 | 94 | 37 | 3k+ | Text Domain Mismatch | ||
| #871 | AWCA – The Great Analytics Insights for Your eStore | 38 | 238 | 143 | 2k+ | Output is not escaped | ||
| #872 | Advanced 301 and 302 Redirect | 38 | 81 | 339 | 1k+ | Non-prefixed global variable | ||
| #873 | Anant Sites — Elementor & Gutenberg Readymade Template Library Free & Pro Templates | 38 | 20 | 156 | 1k+ | Non-prefixed global variable | ||
| #874 | Before After Image Comparison Slider for Elementor | 38 | 63 | 36 | 10k+ | Text Domain Mismatch | ||
| #875 | Elemailer Lite – Elementor email template & campaign builder | 38 | 44 | 50 | 5k+ | Output is not escaped | ||
| #876 | Buttonizer – Social Media Share Buttons, Social Icons, & Social Feeds | 38 | 167 | 82 | 40k+ | Output is not escaped | ||
| #877 | GoDaddy Payments for WooCommerce | 38 | 58 | 65 | 2k+ | Output is not escaped | ||
| #878 | HashThemes Demo Importer | 38 | 71 | 44 | 6k+ | Output is not escaped | ||
| #879 | Icegram Mailer – Reliable Email Deliverability, No-code SMTP Replacement & Email logs | 38 | 36 | 106 | 1k+ | Non-prefixed global variable | ||
| #880 | imoje | 38 | 62 | 160 | 2k+ | Nonce verification recommended | ||
| #881 | Monetag Official Plugin | 38 | 133 | 32 | 5k+ | Text Domain Mismatch | ||
| #882 | Multiple Domain Mapping on Single Site | 38 | 135 | 51 | 6k+ | Text Domain Mismatch | ||
| #883 | OneSignal – Web Push Notifications | 38 | 53 | 64 | 70k+ | Output is not escaped | ||
| #884 | Page Links To | 38 | 31 | 40 | 100k+ | Unsafe printing function | ||
| #885 | LinkBoss – Semantic AI Internal Linking | 38 | 28 | 57 | 2k+ | Missing Arg Domain | ||
| #886 | Simple JWT Login – Allows you to use JWT on REST endpoints. | 38 | 712 | 95 | 4k+ | Output is not escaped | ||
| #887 | Slickstream: Engagement and Conversions | 38 | 100 | 19 | 3k+ | Output is not escaped | ||
| #888 | WholesaleX – B2B & Wholesale Plugin for WooCommerce with Wholesale Prices | 38 | 33 | 181 | 2k+ | Non-prefixed global variable | ||
| #889 | WishSuite – Wishlist for WooCommerce | 38 | 76 | 133 | 1k+ | Output is not escaped | ||
| #890 | Native PHP Sessions | 38 | 30 | 92 | 10k+ | Direct Query | ||
| #891 | Accounting for WooCommerce | 39 | 87 | 115 | 500 | Unsafe printing function | ||
| #892 | Accessibility by AllAccessible | 39 | 200 | 82 | 2k+ | Unsafe printing function | ||
| #893 | Better Random Redirect | 39 | 88 | 40 | 700 | Text Domain Mismatch | ||
| #894 | Blackhole for Bad Bots | 39 | 123 | 69 | 30k+ | Output is not escaped | ||
| #895 | Blogger Importer Extended | 39 | 55 | 45 | 4k+ | Output is not escaped | ||
| #896 | Deliverability – pass DKIM, SPF, DMARC & more | 39 | 21 | 71 | 800 | Nonce verification recommended | ||
| #897 | Flamix: Bitrix24 and WooCommerce Orders integration | 39 | 81 | 31 | 500 | Output is not escaped | ||
| #898 | GDPRess | Eliminate external requests to increase GDPR compliance | 39 | 60 | 26 | 1k+ | Output is not escaped | ||
| #899 | HD Quiz | 39 | 252 | 82 | 7k+ | Output is not escaped | ||
| #900 | Hide My WP Lite | 39 | 24 | 62 | 400 | Nonce verification recommended |
