WordPress.WP.AlternativeFunctions.rand_mt_rand
rand mt rand
The plugin uses a random function that may not be appropriate for the task.
Why It Shows Up
The scan found functions such as `rand()`, `mt_rand()`, `srand()`, or `mt_srand()`.
Why It Matters
General random functions are not suitable for security-sensitive tokens and manual seeding can reduce randomness.
How to Fix
- Use `wp_rand()` for ordinary WordPress randomness.
- Use PHP cryptographic randomness for security-sensitive tokens.
- Avoid manual random seeding unless there is a narrow, documented reason.
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #301 | CP Multi View Events Calendar | 26 | 86 | 439 | 1k+ | Non-prefixed global variable | ||
| #302 | FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) | 26 | 594 | 417 | 2k+ | Exception output is not escaped | ||
| #303 | Media File Renamer: Rename for better SEO (AI-Powered) | 26 | 154 | 170 | 40k+ | Direct Query | ||
| #304 | Online Contact Widget-多合一在线客服插件 | 26 | 708 | 80 | 800 | Non Singular String Literal Domain | ||
| #305 | Send Users Email – Email Subscribers, Email Marketing Newsletter | 26 | 188 | 415 | 5k+ | Non-prefixed global variable | ||
| #306 | WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder | 26 | 265 | 793 | 30k+ | Missing nonce verification | ||
| #307 | XL NMI Gateway for WooCommerce | 26 | 695 | 436 | 1k+ | Text Domain Mismatch | ||
| #308 | WPCOM Member | 26 | 432 | 638 | 1k+ | Non Singular String Literal Domain | ||
| #309 | Polls CP | 27 | 399 | 500 | 400 | Output is not escaped | ||
| #310 | Login for Google Apps | 27 | 139 | 85 | 10k+ | Exception output is not escaped | ||
| #311 | Gravity Forms + Stripe | 27 | 368 | 210 | 600 | Output is not escaped | ||
| #312 | MW WP Form | 27 | 334 | 219 | 200k+ | Output is not escaped | ||
| #313 | Quick Paypal Payments | 27 | 101 | 303 | 1k+ | Non-prefixed function | ||
| #314 | WP Hide & Security Enhancer | 27 | 124 | 375 | 50k+ | Input is not sanitized | ||
| #315 | Redirection for Contact Form 7 | 27 | 34 | 374 | 200k+ | Non-prefixed global variable | ||
| #316 | Code Engine – PHP Snippets, AI Functions & Automation for WordPress | 28 | 124 | 101 | 700 | Non Singular String Literal Domain | ||
| #317 | Contact Form by BestWebSoft – Advanced WP Contact Form Builder for WordPress | 28 | 465 | 338 | 30k+ | Text Domain Mismatch | ||
| #318 | Database Cleaner | 28 | 137 | 297 | 10k+ | Direct Query | ||
| #319 | Expand Divi | 28 | 91 | 100 | 1k+ | Non-prefixed global variable | ||
| #320 | Reviews and Rating – Google Reviews | 28 | 343 | 219 | 20k+ | Text Domain Mismatch | ||
| #321 | Photo Gallery – GT3 Image Gallery & Gutenberg Block Gallery | 28 | 384 | 175 | 10k+ | Text Domain Mismatch | ||
| #322 | WP to LinkedIn Auto Publish | 28 | 734 | 250 | 900 | Unsafe printing function | ||
| #323 | MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor | 28 | 62 | 248 | 600k+ | Non-prefixed global variable | ||
| #324 | ووکامرس فارسی | 28 | 157 | 215 | 90k+ | Output is not escaped | ||
| #325 | Responsive Lightbox & Gallery | 28 | 139 | 513 | 100k+ | Non-prefixed hook name | ||
| #326 | Brilliant Web-to-Lead for Salesforce | 28 | 247 | 244 | 2k+ | Text Domain Mismatch | ||
| #327 | Transliterator – Multilingual and Multi-script Text Conversion | 28 | 305 | 320 | 3k+ | Output is not escaped | ||
| #328 | Slider Pro | 28 | 583 | 527 | 4k+ | Unsafe printing function | ||
| #329 | Tab – Accordion, FAQ | 28 | 104 | 542 | 1k+ | Non-prefixed global variable | ||
| #330 | WP Mapbox GL JS Maps | 28 | 104 | 119 | 1k+ | Output is not escaped | ||
| #331 | Connect Matomo – Analytics Dashboard for WordPress | 28 | 100 | 102 | 60k+ | Missing Translators Comment | ||
| #332 | WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) | 28 | 209 | 217 | 10k+ | Exception output is not escaped | ||
| #333 | WPS Bidouille | 28 | 472 | 215 | 10k+ | Output is not escaped | ||
| #334 | Accordion Slider | 29 | 391 | 447 | 2k+ | Unsafe printing function | ||
| #335 | Better Google Analytics | 29 | 376 | 869 | 2k+ | Non-prefixed global variable | ||
| #336 | Display Tweets | 29 | 135 | 135 | 900 | Non-prefixed global variable | ||
| #337 | DoLogin Security | 29 | 312 | 305 | 7k+ | Output is not escaped | ||
| #338 | Login Me Now – Passwordless, Magic Link, OTP & Social Login for WordPress | 29 | 86 | 233 | 500 | Nonce verification recommended | ||
| #339 | Meow Gallery | 29 | 113 | 182 | 10k+ | Direct Query | ||
| #340 | PhastPress | 29 | 95 | 52 | 10k+ | Exception output is not escaped | ||
| #341 | Responder | 29 | 77 | 185 | 3k+ | Non-prefixed global variable | ||
| #342 | Social Engine | 29 | 133 | 90 | 600 | Exception output is not escaped | ||
| #343 | SQLite Database Integration | 29 | 161 | 89 | 3k+ | Exception output is not escaped | ||
| #344 | ووسلام – همگام سازی ووکامرس و باسلام | 29 | 192 | 611 | 4k+ | Non-prefixed global variable | ||
| #345 | Contact Form 7 Connector | 30 | 324 | 196 | 5k+ | Text Domain Mismatch | ||
| #346 | Invisible reCaptcha for WordPress | 30 | 90 | 185 | 80k+ | Input is not sanitized | ||
| #347 | Real Cookie Banner: GDPR & ePrivacy Cookie Consent | 30 | 9 | 496 | 100k+ | Database parameter is not escaped | ||
| #348 | Rublon Multi-Factor Authentication (MFA) | 30 | 216 | 160 | 500 | Output is not escaped | ||
| #349 | SMTP for Amazon SES – YaySMTP | 30 | 197 | 122 | 3k+ | Exception output is not escaped | ||
| #350 | WooCommerce Tax (formerly WooCommerce Shipping & Tax) | 30 | 103 | 198 | 600k+ | Non-prefixed class |
