PluginScore

compressed_files

Compressed files included

The plugin package contains nested archives or compressed files.

critical weight

Why It Shows Up

Plugin Check found ZIP, TAR, GZ, or similar compressed files inside the plugin package.

Why It Matters

Nested archives hide code from normal review and can increase supply-chain risk or bloat the release.

How to Fix

  • Do not ship backup archives, vendor source archives, or release ZIPs inside the plugin.
  • Extract required assets into normal files or fetch optional data through documented runtime flows.
  • Review packaging scripts so archives are not copied into the release by accident.

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#1Themify Builder95,3042,1365k+Text Domain Mismatch
#2Visual Composer Website Builder168232040k+Non-prefixed global variable
#3MDTF – Meta Data and Taxonomies Filter161,5501,9561k+Non-prefixed global variable
#4WPtouch – Make your WordPress Website Mobile-Friendly171,46632550k+Text Domain Mismatch
#5Podlove Podcast Publisher182,3541,4333k+Output is not escaped
#6WPPizza – A Restaurant Plugin184,6892,7031k+Text Domain Mismatch
#7Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons1910,340360100k+Text Domain Mismatch
#8Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps)193,2753,2289k+Output is not escaped
#9Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)195363793m+Missing Translators Comment
#10Microthemer Lite – Visual Editor to Customize CSS201,0041,69910k+Non-prefixed global variable
#11Feeds for YouTube (YouTube video, channel, and gallery plugin)21558978100k+Output is not escaped
#12PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI)21485813400Missing direct file access protection
#13Trace My IP – Visitor IP Tracker, Stats Analytics & Page Views Counter with Email Alerts218713381k+wp function not compatible with requires wp
#14IS-theme-companion213,5595111k+Non Singular String Literal Domain
#15WP Sessions Time Monitoring Full Automatic228691,529500Non-prefixed global variable
#16Seraphinite Accelerator2259525550k+Output is not escaped
#17Swift Performance Lite222,3461,3256k+Text Domain Mismatch
#18Peach Payments Gateway223341431k+Non Singular String Literal Domain
#19BA Book Everything231,1841,08610k+Output is not escaped
#20BlossomThemes Email Newsletter2333723920k+Output is not escaped
#21WPBot – AI ChatBot for Live Support, Lead Generation, AI Services235141,2205k+Non-prefixed global variable
#22Revive.so – Bulk Rewrite and Republish Blog Posts23332228600Text Domain Mismatch
#23PostFinance Checkout239952211k+Text Domain Mismatch
#24wallee24331220400Exception output is not escaped
#25Jetpack CRM – Clients, Leads, Invoices, Billing, Email Marketing, & Automation241,2113,15330k+Non-prefixed global variable
#26Prime Slider Addons for Elementor – Widgets, Templates & Elementor Addons253,429220100k+Text Domain Mismatch
#27Themify Event Post253971433k+Output is not escaped
#28Kadence Starter Templates — Predesigned Website Templates28312215200k+Missing Arg Domain
#29Pixel Gallery Addons for Elementor – Easy Grid, Creative Gallery, Drag and Drop Grid, Custom Grid Layout, Portfolio Gallery281462595k+Post Not In exclude
#30aThemes Starter Sites2927721640k+Text Domain Mismatch
#31Themify Popup292321088k+Text Domain Mismatch
#32Themify – WooCommerce Product Filter2964314520k+Output is not escaped
#33Themify Portfolio Post3021410230k+Text Domain Mismatch
#34Ultimate Post Kit Addons for Elementor301340330k+Missing nonce verification
#35Themify Store Locator31244125500Text Domain Mismatch
#36WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters3322245260k+wp function not compatible with requires wp
#37Ad Invalid Click Protector (AICP)35784510k+Text Domain Mismatch
#38BabyLoveGrowth Integration352151k+Direct Query
#39Lord of the Files: Enhanced Upload Security3562421k+Non-prefixed global variable
#40Block Comment Spam Bots353117800Output is not escaped
#41BSK Forms Blacklist358315501k+Output is not escaped
#42Conditional Menus35922860k+Text Domain Mismatch
#43Currency Switcher for WooCommerce3516661800Text Domain Mismatch
#44Dadevarzan WordPress Common355671600Text Domain Mismatch
#45DMCA Website Protection Badge35321k+Compressed files included
#46Metadata Viewer35211500Non-prefixed global variable
#47Presto Player353778100k+Missing Arg Domain
#48Quran multilanguage Text & Audio35177166500Output is not escaped
#49ReviewX – Multi-Criteria Reviews for WooCommerce with Google Reviews & Schema3586327k+Unsafe printing function
#50Themify Audio Dock35229900Non-prefixed global variable