PluginScore

WordPress.WP.AlternativeFunctions.rand_mt_rand

rand mt rand

The plugin uses a random function that may not be appropriate for the task.

medium weight

Why It Shows Up

The scan found functions such as `rand()`, `mt_rand()`, `srand()`, or `mt_srand()`.

Why It Matters

General random functions are not suitable for security-sensitive tokens and manual seeding can reduce randomness.

How to Fix

  • Use `wp_rand()` for ordinary WordPress randomness.
  • Use PHP cryptographic randomness for security-sensitive tokens.
  • Avoid manual random seeding unless there is a narrow, documented reason.

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#451Omnibus — show the lowest price41353710k+Output is not escaped
#452OSS Aliyun4119404k+Request data is not unslashed
#453Simple Lightbox412148100k+Nonce verification recommended
#454Simple Revision Control4134431k+Dynamic hook name
#455Mailster Cool Captcha426528400Text Domain Mismatch
#456PuSHPress42116520k+Missing nonce verification
#457SALERT – Fake Sales Notification WooCommerce4241678k+Non-prefixed global variable
#458Event Tracking for Gravity Forms43342520k+rand mt rand
#459Theme Switcha – Easily Switch Themes for Development and Testing4342537k+Output is not escaped
#460Post Date Randomizer454269k+Unsafe printing function
#461Podcast Player – Your Podcasting Companion461413310k+Non-prefixed global variable
#462Link in Bio Creator – Social4652362k+Non Singular String Literal Domain
#463Advanced Custom Fields: Number Slider47994400Output is not escaped
#464Compress, Resize & Lazy Load Images – WPvivid Image Optimization471075810k+Missing direct file access protection
#465Dynamic Pricing and Discount Rules5124651k+Non Singular String Literal Text
#466Dolyame Payment gateway5112210700Text Domain Mismatch
#467GSheetConnector for Gravity Forms – Send Gravity Forms Entries to Google Sheets in Real-Time5226271k+Exception output is not escaped
#468FakerPress536615210k+Non-prefixed global variable
#469PWA — easy way to Progressive Web App5415442k+Dynamic hook name
#470Anti-Captcha (anti-spam botblocker)5623261k+rand mt rand
#471Videopack582810810k+Input is not sanitized
#472RealHomes PayPal Payments605523400Non Singular String Literal Domain
#473RSS Feed Retriever612387k+wp function not compatible with requires wp
#474IndexNow Plugin631491100k+error log error log
#475Estonian Shipping Methods for WooCommerce6497161k+Text Domain Mismatch
#476WP-Farsi652636600Non-prefixed function
#477CP Media Player – Audio Player and Video Player66224483k+Text Domain Mismatch
#478Text Expander675015600wp function not compatible with requires wp
#479Auto Update Post Date6911231k+Input is not validated
#480Simple Login Captcha70201910k+date date
#481Bing URL Submissions Plugin74103840k+error log error log
#482Retainful – WooCommerce Abandoned Cart, Newsletters, Email Marketing, Signup Forms and Automation7915261k+Non-prefixed hook name
#483ERE Recently Viewed – Essential Real Estate Add-On81631k+Output is not escaped
#484OG — Better Share on Social Media81145130k+Non-prefixed hook name
#485Orphans8114350k+Dynamic hook name
#486Hello Dolly8592600k+Output is not escaped
#487MD5 Media Renamer85819400Non-prefixed global variable
#488Latest Posts Block – Dynamic Posts Grid, Posts List, Posts Tile with Stunning Layouts for WordPress Blogs & Pages86987k+Missing Version
#489A Random Number8935800Non-prefixed function
#490Reading Position Indicator90223800Dynamic hook name
#491Snow Monkey Forms91364130k+Non-prefixed global variable