PluginScore

hidden_files

Hidden files included

The plugin package contains hidden files or directories that usually should not ship in a WordPress.org release.

critical weight

Why It Shows Up

Plugin Check found dotfiles, hidden folders, or operating-system metadata in the plugin ZIP.

Why It Matters

Hidden files can leak development metadata, repository configuration, local tooling state, or unexpected content.

How to Fix

  • Exclude dotfiles and local metadata from the release build.
  • Build release ZIPs from a clean export or packaging script.
  • Keep only files required for the plugin to run, document itself, or provide distributed assets.

Affected Plugins

RankPluginScoreErrorsWarningsInstallsAddedUpdatedTop Issue
#151Events Manager – Calendar, Bookings, Tickets, and more!224,7135,66070k+Output is not escaped
#152File Manager Pro – Filester22566391100k+Request data is not unslashed
#153FireBox Popups – Increase Sales and Grow Your Email List221538127k+Non-prefixed global variable
#154Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder22407236700k+Text Domain Mismatch
#155Notification Bar, Announcement and Cookie Notice WordPress Plugin – FooBar221,3211,3713k+Non-prefixed global variable
#156Five Star Restaurant Menu and Food Ordering227526095k+Output is not escaped
#157Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms221,03772220k+Unsafe printing function
#158Hesabfa Accounting22467718400Text Domain Mismatch
#159IMPress for IDX Broker221,0856366k+Text Domain Mismatch
#160The Innovative Form Builder – IvyForms22713250600Exception output is not escaped
#161InfiniteWP Client222,2861,812200k+Exception output is not escaped
#162Import WP – Export and Import CSV and XML files to WordPress225803304k+Exception output is not escaped
#163JCH Optimize221,1451364k+Output is not escaped
#164Jim Soft Swiss QR Invoice22263392400Non-prefixed global variable
#165MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.222,6252,45810k+Output is not escaped
#166Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider22207323500k+Non-prefixed global variable
#167Modula Image Gallery – Photo Grid & Video Gallery22474436100k+Text Domain Mismatch
#168myCred Addons – Ultimate myCred Modules To Support WordPress Gamification and Loyalty Rewards222,3441,320400Output is not escaped
#169Newsletters222,9682,2482k+Text Domain Mismatch
#170NinjaFirewall (WP Edition) – Advanced Security Plugin and Firewall221,2722,063100k+Non-prefixed global variable
#171NinjaScanner – Virus & Malware scan2259655130k+Non-prefixed global variable
#172WP OAuth Server (OAuth Authentication)221893473k+Non-prefixed function
#173oik224891802k+Non Singular String Literal Domain
#174Packeta228013338k+Exception output is not escaped
#175PDF Builder for WPForms22321266900SQL query is not prepared
#176Smart Popup by Supsystic223,17250310k+Non Singular String Literal Domain
#177Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App221,5812,326300k+Non-prefixed global variable
#178Prime Mover – Migrate WordPress Website & Backups221,3261,60010k+Non-prefixed global variable
#179Pronamic Pay222581,0772k+Non-prefixed global variable
#180PageSpeed Ninja – Cache, Minify, Defer CSS JavaScript, Critical CSS, Optimize Images, Convert WebP229844075k+Unsafe printing function
#181Quick Contact Form222606231k+Non-prefixed function
#182RabbitLoader Cache: Optimize your Website for Speed222411632k+Output is not escaped
#183Salon Booking System – Free Version226556202k+Missing direct file access protection
#184Sellsy22586490400Non Singular String Literal Domain
#185ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF221,044800300k+Non-prefixed global variable
#186Simple Job Board226341,35510k+Non-prefixed global variable
#187SNS Count Cache229181208k+Non Singular String Literal Domain
#188SSL Zen — SSL Certificate Installer & HTTPS Redirects227511,60510k+Non-prefixed global variable
#189Stylish Price List – Price Table Builder & QR Code Restaurant Menu226746783k+Output is not escaped
#190SVG Flags – Beautiful Scalable Flags For All Countries!227551,2512k+Non-prefixed global variable
#19110Web Booster – Website speed optimization, Cache & Page Speed optimizer2251360180k+Non-prefixed global variable
#192The Moneytizer227512711k+Text Domain Mismatch
#193Customize Feeds for Twitter22921714k+Non-prefixed global variable
#194Ultimeter227511,3441k+Non-prefixed global variable
#195Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin225322,36740k+Direct Query
#196Uncanny Toolkit for LearnDash2253999420k+Output is not escaped
#197RapidLoad AI – Optimize Web Vitals Automatically2281840700Nonce verification recommended
#198Search & Replace Everything – Quick and Easy Way to Find and Replace Text, Links221,0441,79720k+Non-prefixed global variable
#199Welcart e-Commerce2210,37810,93110k+Text Domain Mismatch
#200Walker Core221,3511,436700Non-prefixed global variable