allow_unfiltered_uploads_detected
allow unfiltered uploads detected
Plugin Check reported a maintainability issue that can make the plugin harder to review, run, or update.
Why It Shows Up
The finding matches a WordPress coding-standard or Plugin Check rule for code clarity, compatibility, packaging, or API usage.
Why It Matters
Maintainability findings reduce confidence that the plugin will behave consistently across hosts, WordPress versions, and other plugins.
How to Fix
- Find the exact file and line in the raw scan output.
- Prefer WordPress APIs and standard coding patterns over custom or legacy behavior.
- If the warning is from bundled third-party code, document that separately and avoid modifying vendor files unless necessary.
References
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #1 | Plugin Check (PCP) | 0 | 128 | 140 | 10k+ | Non-prefixed global variable | ||
| #2 | Administrator Z | 18 | 2,061 | 799 | 400 | Output is not escaped | ||
| #3 | Cost Calculator Builder | 20 | 323 | 766 | 20k+ | Non-prefixed global variable | ||
| #4 | Modular DS: Monitor, update, and backup multiple websites | 21 | 199 | 82 | 40k+ | Exception output is not escaped | ||
| #5 | User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor | 21 | 739 | 1,495 | 40k+ | Non-prefixed global variable | ||
| #6 | Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI | 22 | 397 | 1,369 | 90k+ | Non-prefixed global variable | ||
| #7 | Houzez Property Feed | 23 | 1,416 | 1,585 | 1k+ | Text Domain Mismatch | ||
| #8 | ThemeHunk Customizer | 23 | 3,968 | 582 | 6k+ | Text Domain Mismatch | ||
| #9 | Vayu Blocks – Website Builder for the Gutenberg Block Editor | 23 | 176 | 235 | 900 | Text Domain Mismatch | ||
| #10 | WP User Manager – User Profile Builder & Membership | 23 | 786 | 538 | 10k+ | Exception output is not escaped | ||
| #11 | Media Library Folders | 24 | 894 | 795 | 10k+ | Text Domain Mismatch | ||
| #12 | WPMobile.App – Android and iOS App Builder | 24 | 2,982 | 1,535 | 3k+ | Output is not escaped | ||
| #13 | Agile Store Locator | 25 | 3,348 | 1,834 | 10k+ | Text Domain Mismatch | ||
| #14 | Hunk Companion | 25 | 1,945 | 647 | 5k+ | Output is not escaped | ||
| #15 | SecuPress with Simple SSL – Simple and Performant Security | 25 | 1,725 | 1,726 | 40k+ | Non-prefixed global variable | ||
| #16 | Query Monitor | 31 | 44 | 273 | 200k+ | Non-prefixed class | ||
| #17 | Easy Upload Files During Checkout | 32 | 219 | 211 | 500 | Unsafe printing function | ||
| #18 | Members – Membership & User Role Editor Plugin | 32 | 233 | 259 | 300k+ | Output is not escaped | ||
| #19 | System Dashboard | 32 | 91 | 205 | 900 | Request data is not unslashed | ||
| #20 | Big File Uploads – Increase Maximum File Upload Size | 32 | 65 | 116 | 100k+ | Input is not sanitized | ||
| #21 | Zita Site Library for Elementor | 33 | 107 | 135 | 1k+ | Text Domain Mismatch | ||
| #22 | TBThemes Theme Import | 35 | 84 | 48 | 400 | Text Domain Mismatch | ||
| #23 | Roles & Capabilities | 44 | 24 | 79 | 1k+ | Nonce verification recommended | ||
| #24 | Debug This | 52 | 43 | 32 | 2k+ | Missing Translators Comment | ||
| #25 | Export & Import WPBakery Page Builder | 56 | 12 | 20 | 9k+ | Missing nonce verification | ||
| #26 | Stencil | 92 | 6 | 8 | 1k+ | Non-prefixed function | ||
| #27 | UltraAddons for Elementor | 92 | 63 | 2 | 600 | wp function not compatible with requires wp |
