PluginScore

WordPress.WP.AlternativeFunctions.rand_mt_rand

rand mt rand

The plugin uses a random function that may not be appropriate for the task.

medium weight

Why It Shows Up

The scan found functions such as `rand()`, `mt_rand()`, `srand()`, or `mt_srand()`.

Why It Matters

General random functions are not suitable for security-sensitive tokens and manual seeding can reduce randomness.

How to Fix

  • Use `wp_rand()` for ordinary WordPress randomness.
  • Use PHP cryptographic randomness for security-sensitive tokens.
  • Avoid manual random seeding unless there is a narrow, documented reason.

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#51Accept Stripe Payments2137388220k+Missing nonce verification
#52TotalPoll for Polls and Contests211,3661551k+Text Domain Mismatch
#53Revive Social – Social Media Auto Post and Scheduling Automation Plugin2125542520k+Non-prefixed hook name
#54UPC/EAN/GTIN Barcode Generator/Importer21776311500Exception output is not escaped
#55Buckaroo Woocommerce Payments Plugin215843262k+Exception output is not escaped
#56WebP Express21160427300k+Non-prefixed global variable
#57Paysera Payment Gateway for WooCommerce211,8661957k+Exception output is not escaped
#58Wordfence Security – Firewall, Malware Scan, and Login Security211,5922,9735m+Output is not escaped
#59WP Compress – Instant Performance & Speed Optimization213,3493,21810k+Non Singular String Literal Domain
#60WP phpMyAdmin214,5286,43550k+Missing Arg Domain
#61wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin211,8111,43270k+Output is not escaped
#62WebTotem Security211,110213900Text Domain Mismatch
#63Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots221,6042,01910k+Direct Query
#64Captcha by BestWebSoft – Advanced Spam Protection, Math & OCR-Friendly Captcha for Site Forms2249329510k+Text Domain Mismatch
#65Accept PayPal Payments using Contact Form 722359127600Text Domain Mismatch
#66RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login223,6545,0618k+Non-prefixed global variable
#67SysBasics Customize My Account for WooCommerce – Live My Account Customizer227428528k+Non-prefixed global variable
#68Data Tables Generator by Supsystic2215715010k+Exception output is not escaped
#69Database Access with Adminer229832,5531k+Non-prefixed global variable
#70Download Manager222,2901,301100k+Output is not escaped
#71Diverse Solutions IDX Real Estate Listings & MLS Search227456051k+Heredoc Output Not Escaped
#72Events Maker by dFactory225888191k+Output is not escaped
#73File Manager Pro – Filester22565391100k+Request data is not unslashed
#74Five Star Restaurant Menu and Food Ordering227526095k+Output is not escaped
#75FunnelKit Payment Gateway for Stripe WooCommerce2224432120k+Input is not sanitized
#76GeoDirectory – WP Business Directory Plugin and Classified Listings Directory224,4663,97210k+Output is not escaped
#77Heureka22557254400Exception output is not escaped
#78Insert or Embed Articulate Content into WordPress226591,4372k+Non-prefixed global variable
#79InfiniteWP Client222,2861,812200k+Exception output is not escaped
#80LearnPress – WordPress LMS Plugin for Create and Sell Online Courses222,3613,38470k+Non-prefixed global variable
#81Mail Baby SMTP22385699600SQL query is not prepared
#82MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.222,6192,45310k+Output is not escaped
#83MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution221,1311,844800Non-prefixed global variable
#84Moloni229023562k+Missing Arg Domain
#85Newsletters222,9682,2482k+Text Domain Mismatch
#86NinjaFirewall (WP Edition) – Advanced Security Plugin and Firewall221,2652,065100k+Non-prefixed global variable
#87Smart Popup by Supsystic223,17250310k+Non Singular String Literal Domain
#88Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App221,5812,326300k+Non-prefixed global variable
#89PageSpeed Ninja – Cache, Minify, Defer CSS JavaScript, Critical CSS, Optimize Images, Convert WebP229844075k+Unsafe printing function
#90Quick Contact Form222606231k+Non-prefixed function
#91Slim Jetpack222,5861,9472k+Text Domain Mismatch
#92SNS Count Cache229181208k+Non Singular String Literal Domain
#93NextScripts: Social Networks Auto-Poster222,4081,13330k+Output is not escaped
#94SportsPress – Sports Club & League Manager224602,24210k+Non-prefixed global variable
#95Swift Performance Lite222,3461,3257k+Text Domain Mismatch
#96Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent222255198k+error log error log
#97Customize Feeds for Twitter22921714k+Non-prefixed global variable
#98Search & Replace Everything – Quick and Easy Way to Find and Replace Text, Links221,0441,79720k+Non-prefixed global variable
#99UpStream: a Project Management Plugin for WordPress22683703600Non-prefixed global variable
#100URL Shortify – Simple and Easy URL Shortener221,5202,68910k+Non-prefixed global variable