WordPress.WP.AlternativeFunctions.parse_url_parse_url
parse url parse url
The plugin uses raw URL parsing where WordPress URL helpers may be safer or more compatible.
Why It Shows Up
Plugin Check found `parse_url()` in plugin code.
Why It Matters
URL parsing is easy to get subtly wrong, especially with relative URLs, encoded values, and malformed input.
How to Fix
- Use WordPress helpers such as `wp_parse_url()`, `esc_url_raw()`, `esc_url()`, and `wp_http_validate_url()` where they fit.
- Validate schemes and hosts before using parsed URL parts.
- Do not use parsed URLs to build redirects or requests without allowlisting.
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #901 | Blogger Importer Extended | 39 | 55 | 45 | 4k+ | Output is not escaped | ||
| #902 | Deliverability – pass DKIM, SPF, DMARC & more | 39 | 21 | 71 | 800 | Nonce verification recommended | ||
| #903 | Flamix: Bitrix24 and WooCommerce Orders integration | 39 | 81 | 31 | 500 | Output is not escaped | ||
| #904 | GDPRess | Eliminate external requests to increase GDPR compliance | 39 | 60 | 26 | 1k+ | Output is not escaped | ||
| #905 | HD Quiz | 39 | 252 | 82 | 7k+ | Output is not escaped | ||
| #906 | Hide My WP Lite | 39 | 24 | 62 | 400 | Nonce verification recommended | ||
| #907 | Improved Save Button | 39 | 44 | 52 | 4k+ | Missing Translators Comment | ||
| #908 | Library Viewer | 39 | 65 | 93 | 400 | Non-prefixed hook name | ||
| #909 | linkPizza-Manager | 39 | 46 | 23 | 700 | Exception output is not escaped | ||
| #910 | Re Gallery – Responsive Image & Photo Gallery | 39 | 16 | 121 | 700 | Missing nonce verification | ||
| #911 | SimpleModal Login | 39 | 50 | 12 | 700 | Unsafe printing function | ||
| #912 | Spreadr Woocommerce Plugin – Amazon Importer for Dropshipping and Affiliate | 39 | 42 | 226 | 500 | Request data is not unslashed | ||
| #913 | Substack Importer | 39 | 33 | 33 | 1k+ | Missing nonce verification | ||
| #914 | UiChemy — Figma Converter for Elementor, Gutenberg and Bricks | 39 | 8 | 100 | 9k+ | Nonce verification recommended | ||
| #915 | Visual Portfolio, Photo Gallery & Post Grid | 39 | 34 | 189 | 60k+ | Non-prefixed hook name | ||
| #916 | SEO Auto Linker | 39 | 97 | 62 | 3k+ | Unsafe printing function | ||
| #917 | Add & Replace Affiliate Links for Amazon | 40 | 39 | 52 | 600 | Output is not escaped | ||
| #918 | Mastodon Autopost | 40 | 41 | 50 | 700 | Output is not escaped | ||
| #919 | Complete Image Sitemap | 40 | 55 | 18 | 1k+ | Output is not escaped | ||
| #920 | Easy Document Embedder – Embed Word, excel, Powerpoint, Pdf file and more.. | 40 | 55 | 27 | 500 | Output is not escaped | ||
| #921 | Analytics Germanized for Google Analytics (GDPR / DSGVO) | 40 | 49 | 14 | 7k+ | Output is not escaped | ||
| #922 | Hostinger Reach – AI-Powered Email Marketing for WordPress | 40 | 9 | 45 | 1m+ | Direct Query | ||
| #923 | Video Gallery – YouTube, Vimeo Gallery & YouTube API | 40 | 52 | 74 | 1k+ | Request data is not unslashed | ||
| #924 | Page As Subdomain Lite | 40 | 61 | 25 | 500 | Output is not escaped | ||
| #925 | Plugin Load Filter | 40 | 76 | 112 | 7k+ | Text Domain Mismatch | ||
| #926 | Product Video Gallery for Woocommerce | 40 | 61 | 36 | 10k+ | Setting is missing a sanitization callback | ||
| #927 | Responsive Plus – Elementor Templates & Starter Sites | 40 | 46 | 305 | 10k+ | Non-prefixed global variable | ||
| #928 | Simple Statistics for Feeds | 40 | 64 | 131 | 800 | Nonce verification recommended | ||
| #929 | Statify Widget | 40 | 52 | 13 | 4k+ | Output is not escaped | ||
| #930 | Webo-facto | 40 | 41 | 102 | 1k+ | Nonce verification recommended | ||
| #931 | NP Quote Request for WooCommerce | 40 | 91 | 145 | 9k+ | Non-prefixed global variable | ||
| #932 | WP Help | 40 | 49 | 54 | 10k+ | Unsafe printing function | ||
| #933 | Cache control by Cacholong | 41 | 87 | 30 | 500 | Non Singular String Literal Domain | ||
| #934 | Cookie Notice & Consent | 41 | 101 | 29 | 1k+ | Output is not escaped | ||
| #935 | Heroic Favicon Generator | 41 | 104 | 7 | 6k+ | Output is not escaped | ||
| #936 | Hide WP Admin Login | 41 | 23 | 39 | 500 | Nonce verification recommended | ||
| #937 | Highcompress Image Compressor | 41 | 106 | 69 | 600 | Text Domain Mismatch | ||
| #938 | Mihdan: Yandex Turbo Feed | 41 | 65 | 39 | 1k+ | Output is not escaped | ||
| #939 | Mobile Contact Bar | 41 | 94 | 36 | 10k+ | Unsafe printing function | ||
| #940 | Page Loading Effects | 41 | 68 | 24 | 2k+ | Output is not escaped | ||
| #941 | Simple 301 Redirects By BetterLinks – Easy WordPress Redirect Manager for Redirects, 404 Error Log & More | 41 | 43 | 61 | 100k+ | Request data is not unslashed | ||
| #942 | Simple Page Access Restriction | 41 | 66 | 51 | 6k+ | Unsafe printing function | ||
| #943 | Add to Home Screen & Progressive Web App | 42 | 23 | 68 | 1k+ | Request data is not unslashed | ||
| #944 | Affiliate Link Tracker | 42 | 24 | 49 | 500 | Request data is not unslashed | ||
| #945 | Clover Payments for WooCommerce | 42 | 25 | 15 | 2k+ | Exception output is not escaped | ||
| #946 | Rename wp-admin login | 42 | 23 | 38 | 8k+ | Output is not escaped | ||
| #947 | Simple Download Counter | 42 | 58 | 46 | 2k+ | Output is not escaped | ||
| #948 | Customize Snapshots | 43 | 9 | 42 | 500 | Nonce verification recommended | ||
| #949 | Disable Gutenberg | 43 | 23 | 47 | 500k+ | Nonce verification recommended | ||
| #950 | GD bbPress Tools | 43 | 15 | 61 | 1k+ | Input is not sanitized |
