PluginScore

WordPress.WP.AlternativeFunctions.rand_mt_rand

rand mt rand

The plugin uses a random function that may not be appropriate for the task.

medium weight

Why It Shows Up

The scan found functions such as `rand()`, `mt_rand()`, `srand()`, or `mt_srand()`.

Why It Matters

General random functions are not suitable for security-sensitive tokens and manual seeding can reduce randomness.

How to Fix

  • Use `wp_rand()` for ordinary WordPress randomness.
  • Use PHP cryptographic randomness for security-sensitive tokens.
  • Avoid manual random seeding unless there is a narrow, documented reason.

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#51SeatReg213121,637400Missing nonce verification
#52Professional Social Sharing Buttons, Icons & Related Posts – Shareaholic2132718110k+Output is not escaped
#53Accept Stripe Payments2137389220k+Missing nonce verification
#54TotalPoll for Polls and Contests211,3661551k+Text Domain Mismatch
#55Revive Social – Social Media Auto Post and Scheduling Automation Plugin2125643120k+Non-prefixed hook name
#56UPC/EAN/GTIN Barcode Generator/Importer21776311500Exception output is not escaped
#57URL Shortify – Simple and Easy URL Shortener211,5072,66510k+Non-prefixed global variable
#58Buckaroo Woocommerce Payments Plugin216383212k+Exception output is not escaped
#59WebP Express21160427300k+Non-prefixed global variable
#60Paysera Payment Gateway for WooCommerce211,8681967k+Exception output is not escaped
#61Wordfence Security – Firewall, Malware Scan, and Login Security211,8183,2365m+Output is not escaped
#62WP phpMyAdmin214,5286,43540k+Missing Arg Domain
#63wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin211,8121,43270k+Output is not escaped
#64WebTotem Security211,110213800Text Domain Mismatch
#65Captcha by BestWebSoft – Advanced Spam Protection, Math & OCR-Friendly Captcha for Site Forms2249329510k+Text Domain Mismatch
#66Accept PayPal Payments using Contact Form 722359127600Text Domain Mismatch
#67RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login223,6525,1458k+Non-prefixed global variable
#68Database Access with Adminer229832,5531k+Non-prefixed global variable
#69Download Manager222,5131,459100k+Output is not escaped
#70Diverse Solutions IDX Real Estate Listings & MLS Search227456051k+Heredoc Output Not Escaped
#71Ebook Store224101,054700Non-prefixed global variable
#72Events Maker by dFactory225888191k+Output is not escaped
#73File Manager Pro – Filester22566391100k+Request data is not unslashed
#74Five Star Restaurant Menu and Food Ordering227546105k+Output is not escaped
#75Frontend Dashboard22375941500Non-prefixed function
#76FunnelKit Payment Gateway for Stripe WooCommerce2224432120k+Input is not sanitized
#77GeoDirectory – WP Business Directory Plugin and Classified Listings Directory224,4653,98510k+Output is not escaped
#78Hesabfa Accounting22467718500Text Domain Mismatch
#79Insert or Embed Articulate Content into WordPress226591,4372k+Non-prefixed global variable
#80LearnPress – WordPress LMS Plugin for Create and Sell Online Courses222,4333,59470k+Non-prefixed global variable
#81Mail Baby SMTP22385699600SQL query is not prepared
#82MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.222,6252,45810k+Output is not escaped
#83MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution221,1311,845700Non-prefixed global variable
#84MStore API – Create Native Android & iOS Apps On The Cloud226358563k+SQL query is not prepared
#85Newsletters222,9772,2612k+Text Domain Mismatch
#86NinjaFirewall (WP Edition) – Advanced Security Plugin and Firewall221,2632,046100k+Non-prefixed global variable
#87Packeta228013338k+Exception output is not escaped
#88Smart Popup by Supsystic223,02843910k+Non Singular String Literal Domain
#89Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App221,5812,326300k+Non-prefixed global variable
#90PageSpeed Ninja – Cache, Minify, Defer CSS JavaScript, Critical CSS, Optimize Images, Convert WebP229844075k+Unsafe printing function
#91Quick Contact Form222606231k+Non-prefixed function
#92Slim Jetpack222,5861,9472k+Text Domain Mismatch
#93SNS Count Cache229181207k+Non Singular String Literal Domain
#94Swift Performance Lite222,3461,3256k+Text Domain Mismatch
#95Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent222265138k+error log error log
#96Customize Feeds for Twitter22921714k+Non-prefixed global variable
#97Search & Replace Everything – Quick and Easy Way to Find and Replace Text, Links221,0421,80820k+Non-prefixed global variable
#98UpStream: a Project Management Plugin for WordPress22683703600Non-prefixed global variable
#99Welcart e-Commerce2210,36810,88210k+Text Domain Mismatch
#100WCFM Marketplace – Multivendor Marketplace for WooCommerce221,9502,10810k+Non-prefixed global variable