WordPress.WP.AlternativeFunctions.rand_rand
rand rand
The plugin uses a random function that may not be appropriate for the task.
Why It Shows Up
The scan found functions such as `rand()`, `mt_rand()`, `srand()`, or `mt_srand()`.
Why It Matters
General random functions are not suitable for security-sensitive tokens and manual seeding can reduce randomness.
How to Fix
- Use `wp_rand()` for ordinary WordPress randomness.
- Use PHP cryptographic randomness for security-sensitive tokens.
- Avoid manual random seeding unless there is a narrow, documented reason.
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #351 | WordLift – AI powered SEO – Schema | 24 | 278 | 949 | 400 | Non-prefixed hook name | ||
| #352 | Auto Affiliate Links | 24 | 376 | 407 | 3k+ | Output is not escaped | ||
| #353 | WP Fastest Cache – WordPress Cache Plugin | 24 | 541 | 753 | 1m+ | Unsafe printing function | ||
| #354 | Iptanus File Upload | 24 | 509 | 1,325 | 10k+ | Non-prefixed function | ||
| #355 | WP Helper Premium | 24 | 3,908 | 1,515 | 1k+ | Text Domain Mismatch | ||
| #356 | WP Hotel Booking | 24 | 1,232 | 1,533 | 7k+ | Non-prefixed global variable | ||
| #357 | پارسی دیت – Parsi Date | 24 | 106 | 291 | 100k+ | Non-prefixed hook name | ||
| #358 | WP Travel – Ultimate Travel Booking System, Tour Management Engine | 24 | 227 | 1,954 | 4k+ | Non-prefixed hook name | ||
| #359 | WP Travel Engine – Tour Booking Plugin – Tour Operator Software | 24 | 2,012 | 5,689 | 20k+ | Non-prefixed global variable | ||
| #360 | WPAdverts – Classifieds Plugin | 24 | 1,308 | 496 | 4k+ | Output is not escaped | ||
| #361 | WPSpeed – WordPress Speed, Cache & Performance Optimization (Core Web Vitals, PageSpeed 100) | 24 | 482 | 189 | 2k+ | Output is not escaped | ||
| #362 | WpStream – Live Streaming, Video on Demand, Pay Per View | 24 | 1,724 | 742 | 3k+ | Text Domain Mismatch | ||
| #363 | Dynamic Pricing With Discount Rules for WooCommerce | 25 | 165 | 205 | 5k+ | Non-prefixed global variable | ||
| #364 | AdRotate Banner Manager | 25 | 1,363 | 846 | 20k+ | Unsafe printing function | ||
| #365 | Booking for Appointments and Events Calendar – Amelia | 25 | 1,487 | 480 | 90k+ | Exception output is not escaped | ||
| #366 | Appointment Booking Calendar | 25 | 327 | 1,055 | 1k+ | Non-prefixed global variable | ||
| #367 | Appointment Hour Booking – Booking Calendar | 25 | 262 | 1,253 | 10k+ | Non-prefixed global variable | ||
| #368 | Beaver Builder Page Builder – Drag and Drop Website Builder | 25 | 4,463 | 1,819 | 100k+ | Text Domain Mismatch | ||
| #369 | Booking Activities | 25 | 1,036 | 1,469 | 3k+ | Output is not escaped | ||
| #370 | Booking Calendar Contact Form | 25 | 371 | 884 | 500 | Input is not validated | ||
| #371 | Booking Package | 25 | 1,697 | 3,977 | 10k+ | Missing nonce verification | ||
| #372 | Broken Link Checker | 25 | 727 | 600 | 500k+ | Output is not escaped | ||
| #373 | SilentShield – Captcha & Anti-Spam for WordPress (CF7, WPForms, Elementor, WooCommerce) | 25 | 235 | 214 | 10k+ | Database parameter is not escaped | ||
| #374 | Colissimo shipping methods for WooCommerce | 25 | 1,755 | 557 | 10k+ | Text Domain Mismatch | ||
| #375 | Disable Comments & Delete All Comments | 25 | 503 | 185 | 9k+ | Output is not escaped | ||
| #376 | Contact Form Email | 25 | 409 | 898 | 9k+ | Non-prefixed global variable | ||
| #377 | CP Contact Form with PayPal | 25 | 466 | 936 | 800 | Unsafe printing function | ||
| #378 | Smash Balloon Social Post Feed – Simple Social Feeds for WordPress | 25 | 554 | 982 | 200k+ | Output is not escaped | ||
| #379 | DecaLog | 25 | 943 | 236 | 1k+ | Exception output is not escaped | ||
| #380 | Demo Importer Plus | 25 | 58 | 239 | 10k+ | Non-prefixed hook name | ||
| #381 | Disable Admin Notices – Hide Dashboard Notifications | 25 | 465 | 195 | 100k+ | Output is not escaped | ||
| #382 | Events Made Easy | 25 | 521 | 6,324 | 1k+ | Non-prefixed function | ||
| #383 | 胖鼠采集(Fat Rat Collect) | 25 | 630 | 190 | 900 | Missing Arg Domain | ||
| #384 | Photo Gallery by FooGallery : Responsive Image Gallery, Masonry Gallery & Carousel | 25 | 876 | 1,798 | 100k+ | Non-prefixed global variable | ||
| #385 | WP Fast Total Search – The Power of Indexed Search | 25 | 209 | 291 | 1k+ | Non-prefixed global variable | ||
| #386 | Genesis Club Lite | 25 | 513 | 317 | 900 | Output is not escaped | ||
| #387 | Simple Giveaways – Grow your business, email lists and traffic with contests | 25 | 956 | 2,384 | 400 | Non-prefixed global variable | ||
| #388 | Logo Slider – Logo Showcase, Logo Carousel, Logo Gallery and Client Logo Presentation | 25 | 789 | 313 | 30k+ | Text Domain Mismatch | ||
| #389 | Team Members – A WordPress Team Plugin with Gallery, Grid, Carousel, Slider, Table, List, and More | 25 | 1,786 | 2,220 | 2k+ | Non-prefixed global variable | ||
| #390 | Solid Testimonials – Testimonial Slider, Video Testimonials & Customer Reviews | 25 | 645 | 1,585 | 1k+ | Non-prefixed global variable | ||
| #391 | Hydra Booking — Appointment Scheduling & Booking Calendar | 25 | 235 | 699 | 2k+ | Non-prefixed global variable | ||
| #392 | Independent Analytics – WordPress Analytics Plugin | 25 | 1,148 | 2,293 | 100k+ | Non-prefixed global variable | ||
| #393 | Index WP MySQL For Speed | 25 | 250 | 255 | 50k+ | Output is not escaped | ||
| #394 | Smash Balloon Social Photo Feed – Easy Social Feeds Plugin | 25 | 449 | 1,300 | 1m+ | Interpolated SQL is not prepared | ||
| #395 | IP Location Block | 25 | 521 | 624 | 10k+ | Output is not escaped | ||
| #396 | Loginizer | 25 | 814 | 504 | 1m+ | Output is not escaped | ||
| #397 | Logo Showcase – Responsive Logo Carousel, Logo Slider & Logo Grid | 25 | 656 | 1,506 | 5k+ | Non-prefixed global variable | ||
| #398 | Bulk Page Generator – LPagery | 25 | 670 | 1,926 | 3k+ | Non-prefixed global variable | ||
| #399 | Media Cleaner: Clean your WordPress! | 25 | 269 | 520 | 90k+ | Direct Query | ||
| #400 | Media Cloud Sync | 25 | 1,095 | 274 | 1k+ | Exception output is not escaped |
