WordPress.WP.AlternativeFunctions.parse_url_parse_url
parse url parse url
The plugin uses raw URL parsing where WordPress URL helpers may be safer or more compatible.
Why It Shows Up
Plugin Check found `parse_url()` in plugin code.
Why It Matters
URL parsing is easy to get subtly wrong, especially with relative URLs, encoded values, and malformed input.
How to Fix
- Use WordPress helpers such as `wp_parse_url()`, `esc_url_raw()`, `esc_url()`, and `wp_http_validate_url()` where they fit.
- Validate schemes and hosts before using parsed URL parts.
- Do not use parsed URLs to build redirects or requests without allowlisting.
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #951 | LWS Hide Login | 45 | 5 | 58 | 20k+ | Request data is not unslashed | ||
| #952 | Outdooractive Embed | 45 | 70 | 18 | 400 | Text Domain Mismatch | ||
| #953 | reCAPTCHA for Asgaros Forum | 45 | 21 | 36 | 4k+ | Input is not validated | ||
| #954 | TriPay Payment Gateway | 45 | 478 | 44 | 1k+ | Text Domain Mismatch | ||
| #955 | CLP Varnish Cache | 46 | 15 | 58 | 10k+ | Non-prefixed global variable | ||
| #956 | Link in Bio Creator – Social | 46 | 52 | 36 | 2k+ | Non Singular String Literal Domain | ||
| #957 | Flying Pages: Preload Pages for Faster Navigation & Improved User Experience | 47 | 21 | 21 | 20k+ | Missing direct file access protection | ||
| #958 | Groups 404 Redirect | 47 | 35 | 33 | 1k+ | Non Singular String Literal Domain | ||
| #959 | Tabby Checkout | 47 | 33 | 46 | 4k+ | Non-prefixed class | ||
| #960 | 3CX Free Live Chat, Calls & Messaging | 47 | 24 | 16 | 100k+ | Output is not escaped | ||
| #961 | XML Sitemap & Google News | 47 | 270 | 224 | 100k+ | Non-prefixed global variable | ||
| #962 | Ansar Import – One Click Starter Sites – for Elementor & Themes | 48 | 27 | 116 | 10k+ | Non-prefixed global variable | ||
| #963 | ACF Quick Edit Fields | 49 | 20 | 72 | 30k+ | Nonce verification recommended | ||
| #964 | CryptAPI Payment Gateway for WooCommerce | 49 | 185 | 23 | 400 | Text Domain Mismatch | ||
| #965 | GamiPress – Multimedia Content | 49 | 11 | 25 | 500 | Nonce verification recommended | ||
| #966 | Secondary Product Image for WooCommerce | 49 | 25 | 29 | 2k+ | Output is not escaped | ||
| #967 | SpinupWP | 49 | 43 | 38 | 30k+ | Non-prefixed function | ||
| #968 | Auto Ping Booster Free | 50 | 18 | 21 | 900 | Setting is missing a sanitization callback | ||
| #969 | Headline Analyzer | 50 | 13 | 31 | 1k+ | Nonce verification recommended | ||
| #970 | TrustedSite | 50 | 29 | 14 | 20k+ | Output is not escaped | ||
| #971 | Gravatar Enhanced – Avatars, Profiles, and Privacy | 51 | 38 | 48 | 100k+ | Dynamic hook name | ||
| #972 | Mintpay | 51 | 14 | 35 | 600 | Nonce verification recommended | ||
| #973 | Trustpilot Reviews | 51 | 14 | 52 | 30k+ | Missing nonce verification | ||
| #974 | GSheetConnector for Gravity Forms – Send Gravity Forms Entries to Google Sheets in Real-Time | 52 | 26 | 27 | 1k+ | Exception output is not escaped | ||
| #975 | Podium | 52 | 21 | 23 | 5k+ | Missing direct file access protection | ||
| #976 | Multiple Post Thumbnails | 53 | 25 | 18 | 20k+ | Output is not escaped | ||
| #977 | Pinterest for WooCommerce | 53 | 44 | 30 | 300k+ | Exception output is not escaped | ||
| #978 | pretix widget | 53 | 25 | 39 | 400 | Non-prefixed global variable | ||
| #979 | WP User Switch | 53 | 8 | 46 | 1k+ | Input is not sanitized | ||
| #980 | Disqus Comment System | 54 | 17 | 33 | 40k+ | Non-prefixed hook name | ||
| #981 | SpeedSize Image & Video AI-Optimizer | 54 | 98 | 17 | 400 | Text Domain Mismatch | ||
| #982 | Tax Switch for WooCommerce | 54 | 15 | 32 | 900 | Nonce verification recommended | ||
| #983 | Chabok | چابک | 55 | 16 | 31 | 400 | Nonce verification recommended | ||
| #984 | Gutenify – Visual Site Builder Blocks & Site Templates | 55 | 66 | 40 | 5k+ | Missing Arg Domain | ||
| #985 | Hide Admin Menu | 55 | 18 | 27 | 20k+ | Non-prefixed function | ||
| #986 | Marvy – Background Animations for Elementor | 55 | 63 | 34 | 4k+ | Text Domain Mismatch | ||
| #987 | Trusona for WordPress | 55 | 8 | 34 | 500 | Non-prefixed function | ||
| #988 | WP Ultimate Review | 55 | 23 | 381 | 70k+ | Non-prefixed global variable | ||
| #989 | CHEQ Essentials | 56 | 14 | 49 | 700 | Request data is not unslashed | ||
| #990 | Video Dashboard | 56 | 33 | 1 | 500 | Output is not escaped | ||
| #991 | iZooto – Web Push Notifications | 57 | 26 | 25 | 1k+ | wp function not compatible with requires wp | ||
| #992 | Debloat – Remove Unused CSS, Optimize JS | 58 | 24 | 20 | 30k+ | Nonce verification recommended | ||
| #993 | Safety Exit | 58 | 52 | 26 | 1k+ | Text Domain Mismatch | ||
| #994 | Videopack | 58 | 28 | 108 | 10k+ | Input is not sanitized | ||
| #995 | Cloak Affiliate Links for WooCommerce | 58 | 28 | 6 | 2k+ | Non Singular String Literal Domain | ||
| #996 | etracker analytics | 59 | 16 | 9 | 1k+ | Exception output is not escaped | ||
| #997 | Remove Add to Cart Button for WooCommerce | 59 | 115 | 18 | 500 | Text Domain Mismatch | ||
| #998 | Typebot | 59 | 17 | 9 | 3k+ | Output is not escaped | ||
| #999 | Accesibilidad Web con el Widget de AccedeMe | 60 | 22 | 23 | 1k+ | Text Domain Mismatch | ||
| #1000 | Surge | 60 | 46 | 47 | 4k+ | Non-prefixed global variable |
