PluginScore

WordPress.WP.AlternativeFunctions.rand_mt_rand

rand mt rand

The plugin uses a random function that may not be appropriate for the task.

medium weight

Why It Shows Up

The scan found functions such as `rand()`, `mt_rand()`, `srand()`, or `mt_srand()`.

Why It Matters

General random functions are not suitable for security-sensitive tokens and manual seeding can reduce randomness.

How to Fix

  • Use `wp_rand()` for ordinary WordPress randomness.
  • Use PHP cryptographic randomness for security-sensitive tokens.
  • Avoid manual random seeding unless there is a narrow, documented reason.

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#1JetBackup – Backup, Restore & Migrate101,563149200k+Exception output is not escaped
#2Efí Bank17886553400Exception output is not escaped
#3wpForo Forum174,0482,92220k+Unsafe printing function
#4WPtouch – Make your WordPress Website Mobile-Friendly171,46632550k+Text Domain Mismatch
#5Realtyna Organic IDX plugin + WPL Real Estate189303,6362k+Non-prefixed global variable
#6Shopping Cart & eCommerce Store185,37317,4663k+Non-prefixed global variable
#7Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution191,218901100k+Exception output is not escaped
#8Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)195363793m+Missing Translators Comment
#9Membership Plugin – Kadence Memberships195,0832,9829k+Text Domain Mismatch
#10Scrollsequence – Cinematic Scroll Image Animation Plugin198781,5284k+Non-prefixed global variable
#11SendPress Newsletters192,2931,4221k+Output is not escaped
#12WP Import Export Lite1973797940k+Non-prefixed global variable
#13WP Directory Kit191,5042,6382k+Non-prefixed global variable
#14WPJAM Basic193253464k+Output is not escaped
#15WPOSS阿里云对象存储19269315900Non-prefixed namespace
#16WPQiNiu七牛云对象存储19138612400Non-prefixed global variable
#17SysBasics Customize My Account for WooCommerce – Live My Account Customizer207439118k+Non-prefixed global variable
#18Download Monitor204231,36480k+Non-prefixed hook name
#19Event Espresso – Event Registration & Ticketing Sales2012,6982,135600Text Domain Mismatch
#20GiveWP – Donation Plugin and Fundraising Platform203,4103,554100k+Output is not escaped
#21GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership201,832720700Non Singular String Literal Domain
#22Leaky Paywall20322789600Nonce verification recommended
#23MBE eShip205277401k+Non-prefixed global variable
#24Brevo – Email, SMS, Web Push, Chat, and more.20460646100k+Request data is not unslashed
#25Microthemer Lite – Visual Editor to Customize CSS201,0041,69910k+Non-prefixed global variable
#26Nimble Page Builder201,5911,68430k+Missing Arg Domain
#27پلاگین پرداخت دلخواه20584446900Text Domain Mismatch
#28Pix por Piggly (para Woocommerce)205471954k+Exception output is not escaped
#29Events Manager – OpenStreetMaps20559444600Output is not escaped
#30Razorpay for WooCommerce20975859100k+Non-prefixed function
#31WP Compress – Instant Performance & Speed Optimization204,0463,50210k+Non Singular String Literal Domain
#32Backup Migration219991,08180k+Non-prefixed global variable
#33Forumax – AI Powered Advanced Community Forum Plugin214,9364,353600Text Domain Mismatch
#34bbPress219293,672100k+Non-prefixed function
#35Kadence Security – Password, Two Factor Authentication, and Brute Force Protection211,060957700k+Missing Translators Comment
#36Pinpoint Booking System – Version 2216343283k+Missing direct file access protection
#37Booking Ultra Pro Appointments Booking Calendar Plugin217612,083400Request data is not unslashed
#38Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots211,6212,03810k+Direct Query
#39Captcha Them All213003235k+Output is not escaped
#40Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More212,5721,2771m+Output is not escaped
#41EventPrime – Events Calendar, Bookings and Tickets218734,3107k+Non-prefixed global variable
#42FileOrganizer – WordPress File Manager21536241200k+unlink unlink
#43Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More21522,063300k+Non-prefixed global variable
#44Frontend Dashboard21384945500Non-prefixed function
#45Mooberry Book Manager211,0403991k+Text Domain Mismatch
#46MotoPress Hotel Booking213,0671,03710k+Text Domain Mismatch
#47OneLogin SAML SSO215073307k+wp function not compatible with requires wp
#48Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction211,9535,29710k+Non-prefixed hook name
#49Razorpay Quick Payments21399632k+Exception output is not escaped
#50Five Star Restaurant Reservations – WordPress Booking Plugin211,1011,15910k+Output is not escaped