WordPress.WP.DiscouragedConstants.TEMPLATEPATHUsageFound
Discouraged WordPress constant usage: TEMPLATEPATH
The plugin uses a PHP or WordPress pattern that coding standards discourage.
Why It Shows Up
Plugin Check found a discouraged function, forbidden function, goto, backtick operator, or similar construct.
Why It Matters
Discouraged patterns are often harder to review, less portable across hosts, or easier to misuse securely.
How to Fix
- Identify why the construct is used and whether WordPress provides a safer API.
- Replace shell execution, dynamic execution, or broad forbidden functions with constrained WordPress APIs.
- If a third-party library triggers the warning, isolate and document it.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #1 | MDTF – Meta Data and Taxonomies Filter | 16 | 1,550 | 1,956 | 1k+ | Non-prefixed global variable | ||
| #2 | WPtouch – Make your WordPress Website Mobile-Friendly | 17 | 1,466 | 325 | 50k+ | Text Domain Mismatch | ||
| #3 | SendPress Newsletters | 19 | 2,293 | 1,422 | 1k+ | Output is not escaped | ||
| #4 | AweBooking – Hotel Booking System | 20 | 309 | 514 | 1k+ | Non-prefixed global variable | ||
| #5 | Directorist: AI-Powered Business Directory, Listings & Classified Ads | 21 | 484 | 2,327 | 20k+ | Non-prefixed global variable | ||
| #6 | BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages | 21 | 668 | 1,569 | 800 | Non-prefixed global variable | ||
| #7 | Wordfence Security – Firewall, Malware Scan, and Login Security | 21 | 1,893 | 3,292 | 5m+ | Output is not escaped | ||
| #8 | Events Maker by dFactory | 22 | 588 | 819 | 1k+ | Output is not escaped | ||
| #9 | HeadSpace2 SEO | 22 | 940 | 360 | 3k+ | Text Domain Mismatch | ||
| #10 | Slim Jetpack | 22 | 2,586 | 1,947 | 2k+ | Text Domain Mismatch | ||
| #11 | Advanced Custom Fields: Extended | 23 | 1,885 | 329 | 100k+ | Text Domain Mismatch | ||
| #12 | Coupon Creator | 23 | 602 | 424 | 1k+ | Output is not escaped | ||
| #13 | MediaPress | 23 | 904 | 583 | 3k+ | Output is not escaped | ||
| #14 | The Events Calendar | 23 | 3,519 | 3,851 | 600k+ | Text Domain Mismatch | ||
| #15 | Advanced AJAX Product Filters | 23 | 2,850 | 1,254 | 50k+ | Text Domain Mismatch | ||
| #16 | A2 Optimized WP – Turbocharge and secure your WordPress site | 24 | 271 | 231 | 60k+ | Missing Arg Domain | ||
| #17 | All-In-One Security (AIOS) – Security and Firewall | 24 | 552 | 1,228 | 1m+ | Non-prefixed global variable | ||
| #18 | Event Tickets and Registration | 24 | 3,409 | 4,204 | 90k+ | Non-prefixed global variable | ||
| #19 | Gallery by BestWebSoft – Customizable Image and Photo Galleries for WordPress | 24 | 540 | 322 | 10k+ | Text Domain Mismatch | ||
| #20 | Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors | 24 | 338 | 872 | 20k+ | Nonce verification recommended | ||
| #21 | Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers | 24 | 348 | 1,506 | 1k+ | Nonce verification recommended | ||
| #22 | WPeMatico RSS Feed Fetcher | 24 | 1,387 | 586 | 10k+ | Output is not escaped | ||
| #23 | BuddyPress Docs | 25 | 284 | 421 | 6k+ | Nonce verification recommended | ||
| #24 | Front End PM | 25 | 971 | 2,264 | 4k+ | Non-prefixed global variable | ||
| #25 | Genesis Club Lite | 25 | 513 | 317 | 900 | Output is not escaped | ||
| #26 | FV Antispam | 26 | 332 | 239 | 900 | Output is not escaped | ||
| #27 | Live Composer – Free WordPress Website Builder | 26 | 1,196 | 425 | 10k+ | Output is not escaped | ||
| #28 | Post and Page Builder by BoldGrid – Visual Drag and Drop Editor | 30 | 353 | 263 | 50k+ | Text Domain Mismatch | ||
| #29 | BuddyPress for LearnDash | 32 | 190 | 284 | 1k+ | Output is not escaped | ||
| #30 | Download Attachments | 32 | 69 | 188 | 8k+ | Non-prefixed hook name | ||
| #31 | More Types | 33 | 227 | 198 | 700 | Non-prefixed global variable | ||
| #32 | Buckets | 34 | 68 | 76 | 400 | Output is not escaped | ||
| #33 | PublishPress Checklists: Pre-Publishing Approval Checklist – Validate Post Requirements | 34 | 141 | 182 | 3k+ | Missing Translators Comment | ||
| #34 | Advanced Permalinks | 35 | 94 | 76 | 300 | wp function not compatible with requires wp | ||
| #35 | Amministrazione Trasparente | 35 | 80 | 46 | 1k+ | Output is not escaped | ||
| #36 | Social Comments by Heateor | 35 | 285 | 35 | 600 | Unsafe printing function | ||
| #37 | Issuu PDF Sync | 35 | 159 | 28 | 900 | Text Domain Mismatch | ||
| #38 | Custom Post Template | 37 | 48 | 30 | 10k+ | Output is not escaped | ||
| #39 | PostLinks | 38 | 107 | 10 | 900 | Output is not escaped | ||
| #40 | Genesis Dambuster | 39 | 94 | 67 | 3k+ | Output is not escaped | ||
| #41 | SimpleModal Login | 39 | 50 | 12 | 700 | Unsafe printing function | ||
| #42 | TW Recent Posts Widget | 40 | 97 | 14 | 1k+ | Output is not escaped | ||
| #43 | Genesis Featured Page Advanced | 41 | 209 | 4 | 7k+ | Output is not escaped | ||
| #44 | TW Pagination | 41 | 90 | 23 | 1k+ | Non Singular String Literal Domain | ||
| #45 | Contact Details | 45 | 43 | 29 | 1k+ | Non Singular String Literal Text | ||
| #46 | FakerPress | 52 | 66 | 155 | 10k+ | Non-prefixed global variable | ||
| #47 | ONTRApages | 53 | 16 | 27 | 1k+ | Output is not escaped | ||
| #48 | Title Toggle for Storefront Theme | 68 | 16 | 9 | 3k+ | Output is not escaped | ||
| #49 | Embed Iframe | 69 | 25 | 6 | 2k+ | wp function not compatible with requires wp | ||
| #50 | Post Template | 70 | 12 | 11 | 400 | Missing nonce verification |
