PluginScore

WordPress.WP.AlternativeFunctions.rand_rand

rand rand

The plugin uses a random function that may not be appropriate for the task.

medium weight

Why It Shows Up

The scan found functions such as `rand()`, `mt_rand()`, `srand()`, or `mt_srand()`.

Why It Matters

General random functions are not suitable for security-sensitive tokens and manual seeding can reduce randomness.

How to Fix

  • Use `wp_rand()` for ordinary WordPress randomness.
  • Use PHP cryptographic randomness for security-sensitive tokens.
  • Avoid manual random seeding unless there is a narrow, documented reason.

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#601ONet Regenerate Thumbnails35190641k+Text Domain Mismatch
#602Plugin Ongkos Kirim JNE Tiki Sicepat Wahana J&T POS for Woocommerce351171442k+Output is not escaped
#603Paytm Payment Gateway35921043k+Missing Arg Domain
#604Security Optimizer – The All-In-One Protection Plugin3540821m+Request data is not unslashed
#605SiteGround Migrator351137470k+Missing Arg Domain
#606Spacious Toolkit354894700Non-prefixed global variable
#607Stars Testimonials — Responsive Reviews & Star Ratings35292531k+Non-prefixed global variable
#608Team Showcase – Responsive Team Members Grid, Slider & Carousel Plugin351,0004102k+Text Domain Mismatch
#609Theme Blvd Layout Builder352071692k+Output is not escaped
#610Themify Shortcodes3536167k+Output is not escaped
#611TikTok353122200k+Missing Arg Domain
#612Two Factor Authentication3510813920k+Output is not escaped
#613User Photo35112683k+Output is not escaped
#614Video Grid352531061k+Output is not escaped
#615W4 Post List35501383k+Non-prefixed global variable
#616Payment Gateway for PayPal Pro & PayPal Checkout for WooCommerce35671472k+Request data is not unslashed
#617Easy Accept Payments via PayPal353221287k+Text Domain Mismatch
#618WP GPX Maps35271004k+Non-prefixed global variable
#619WP Mailto Links – Protect Email Addresses3595698k+Output is not escaped
#620video carousel slider with lightbox353501361k+Output is not escaped
#621WP Spam Question Filter3563302k+Output is not escaped
#622wpLingua – Automatic translation – Translate and make website multilingual35791672k+Nonce verification recommended
#623Bulk Post Update Date36966610k+Unsafe printing function
#624Crelly Slider3642118510k+Unsafe printing function
#625Doneren met Mollie364203514k+SQL query is not prepared
#626Drag and Drop Multiple File Upload for Contact Form 736823660k+wp function not compatible with requires wp
#627Genesis Sandbox Featured Content Widget36229241k+Text Domain Mismatch
#628Gutena Kit – Gutenberg Blocks and Templates3639871k+Nonce verification recommended
#629HTML5 Maps361941605k+Output is not escaped
#630HTTP Requests Manager3698901k+Output is not escaped
#631Subscribe to Comments3612916310k+Output is not escaped
#632PDF Flipbook, WPBakery Addon – Unreal FlipBook36400921k+Non Singular String Literal Domain
#633Quantity Plus Minus Button for WooCommerce36838410k+Output is not escaped
#634Custom Add to Cart Button Label and Link for WooCommerce363711123k+Text Domain Mismatch
#635Payment Button for PayPal36155864k+Unsafe printing function
#636WP Hardening (discontinued)362308510k+Text Domain Mismatch
#637Visual CSS Style Editor3628323340k+Output is not escaped
#638Login by Auth0373078210k+Text Domain Mismatch
#639Random Posts and Pages Widget37322151k+Output is not escaped
#640ClickRank – Ai SEO Automation37102261k+Direct Query
#641Lightweight Subscribe To Comments37105701k+Unsafe printing function
#642Simple Custom CSS and JS3716869600k+Output is not escaped
#643Easy Testimonial Slider and Form3714144700Request data is not unslashed
#644Horizontal scrolling announcements372151408k+Output is not escaped
#645LearnPress – Course Review37674320k+Output is not escaped
#646Metorik – Reports & Email Automation for WooCommerce37757010k+Output is not escaped
#647NextGEN Scroll Gallery3733281k+Output is not escaped
#648Publish to Schedule37195434k+Text Domain Mismatch
#649SendWP37474210k+Output is not escaped
#650Spam Destroyer3763436k+rand rand