hidden_files
Hidden files included
The plugin package contains hidden files or directories that usually should not ship in a WordPress.org release.
Why It Shows Up
Plugin Check found dotfiles, hidden folders, or operating-system metadata in the plugin ZIP.
Why It Matters
Hidden files can leak development metadata, repository configuration, local tooling state, or unexpected content.
How to Fix
- Exclude dotfiles and local metadata from the release build.
- Build release ZIPs from a clean export or packaging script.
- Keep only files required for the plugin to run, document itself, or provide distributed assets.
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #401 | Post and Page Builder by BoldGrid – Visual Drag and Drop Editor | 32 | 348 | 258 | 50k+ | Output is not escaped | ||
| #402 | Posti Shipping | 32 | 664 | 157 | 1k+ | Text Domain Mismatch | ||
| #403 | Simple Ajax Chat – Add a Fast, Secure Chat Box | 32 | 108 | 266 | 2k+ | Output is not escaped | ||
| #404 | Subscribe2 – Form, Email Subscribers & Newsletters | 32 | 32 | 410 | 10k+ | Direct Query | ||
| #405 | User Registration Using Contact Form 7 | 32 | 103 | 15 | 500 | wp function not compatible with requires wp | ||
| #406 | Multi Currency For WooCommerce | 32 | 87 | 70 | 1k+ | Non-prefixed global variable | ||
| #407 | WooMS | 32 | 199 | 58 | 500 | Output is not escaped | ||
| #408 | WP fail2ban – Advanced Security | 32 | 75 | 153 | 60k+ | Dynamic hook name | ||
| #409 | Bosta WooCommerce | 33 | 303 | 180 | 700 | Text Domain Mismatch | ||
| #410 | CartPops – High Converting Add To Cart Popup For WooCommerce | 33 | 63 | 188 | 4k+ | Non-prefixed global variable | ||
| #411 | CB Custom Beaver Builder Modules | 33 | 748 | 4 | 1k+ | Output is not escaped | ||
| #412 | Conekta Payment Gateway | 33 | 240 | 61 | 2k+ | Text Domain Mismatch | ||
| #413 | Countdown Timer | 33 | 311 | 17 | 900 | Text Domain Mismatch | ||
| #414 | Fastly | 33 | 221 | 66 | 1k+ | Text Domain Mismatch | ||
| #415 | GDPR Cookie Compliance – Cookie Banner, Cookie Consent, Cookie Notice for CCPA, EU Cookie Law | 33 | 48 | 370 | 300k+ | Non-prefixed global variable | ||
| #416 | Ultimate Addons for Elementor | 33 | 81 | 291 | 2m+ | Non-prefixed class | ||
| #417 | InPost Gallery | 33 | 105 | 245 | 700 | Non-prefixed global variable | ||
| #418 | WPZOOM Social Feed Widget & Block | 33 | 310 | 278 | 60k+ | Unsafe printing function | ||
| #419 | jQuery Manager for WordPress | 33 | 86 | 24 | 7k+ | Output is not escaped | ||
| #420 | Logo Showcase Ultimate – Logo Carousel, Logo Slider & Logo Grid | 33 | 274 | 106 | 3k+ | Text Domain Mismatch | ||
| #421 | Mollie Payments for WooCommerce | 33 | 70 | 123 | 100k+ | Dynamic hook name | ||
| #422 | Payflex Payment Gateway | 33 | 181 | 61 | 1k+ | Text Domain Mismatch | ||
| #423 | PeproDev WooCommerce Receipt Uploader | 33 | 325 | 49 | 1k+ | Non Singular String Literal Domain | ||
| #424 | Live Sales Notification (Recent Sales Popups) | 33 | 114 | 120 | 400 | SQL query is not prepared | ||
| #425 | Simple Sticky Add To Cart For WooCommerce | 33 | 401 | 70 | 900 | Text Domain Mismatch | ||
| #426 | Testimonial Slider – Free Testimonials Slider Plugin | 33 | 91 | 50 | 700 | Request data is not unslashed | ||
| #427 | WP Multilang – Translation and Multilingual Plugin | 33 | 53 | 118 | 10k+ | Database parameter is not escaped | ||
| #428 | affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display | 34 | 326 | 75 | 2k+ | Output is not escaped | ||
| #429 | AGCA – Custom Dashboard & Login Page | 34 | 350 | 44 | 20k+ | Unsafe printing function | ||
| #430 | All In One Favicon | 34 | 214 | 62 | 60k+ | Output is not escaped | ||
| #431 | Arconix Shortcodes | 34 | 129 | 108 | 4k+ | Output is not escaped | ||
| #432 | Automatic YouTube Gallery – Embed Auto-Updating YouTube Video Galleries, Feeds, Playlists & Channels | 34 | 86 | 255 | 9k+ | Direct Query | ||
| #433 | BoldGrid Easy SEO – Simple and Effective SEO | 34 | 149 | 104 | 40k+ | Text Domain Mismatch | ||
| #434 | Checkout Field Editor for WooCommerce – Checkout Manager | 34 | 122 | 64 | 20k+ | Text Domain Mismatch | ||
| #435 | Contact Form 7 – PayPal & Stripe Add-on | 34 | 93 | 233 | 7k+ | Exception output is not escaped | ||
| #436 | Document Library Lite | 34 | 149 | 85 | 4k+ | Text Domain Mismatch | ||
| #437 | ePayco Plugin for WooCommerce | 34 | 155 | 136 | 3k+ | Text Domain Mismatch | ||
| #438 | Estimated Delivery for WooCommerce | 34 | 301 | 70 | 1k+ | Short PHP open tag found | ||
| #439 | Featured Video Plus | 34 | 99 | 105 | 10k+ | Non-prefixed global variable | ||
| #440 | Geolocation IP Detection | 34 | 227 | 167 | 20k+ | Output is not escaped | ||
| #441 | JS Archive List | 34 | 99 | 31 | 3k+ | Output is not escaped | ||
| #442 | Kadence WooCommerce Email Designer | 34 | 119 | 230 | 100k+ | Non-prefixed global variable | ||
| #443 | Login with Vipps and MobilePay | 34 | 263 | 174 | 900 | Output is not escaped | ||
| #444 | Melhor Envio | 34 | 24 | 276 | 10k+ | Nonce verification recommended | ||
| #445 | OwnerRez | 34 | 79 | 56 | 700 | Unsafe printing function | ||
| #446 | Responsive Menu – Create Mobile-Friendly Menu | 34 | 68 | 40 | 70k+ | Nonce verification recommended | ||
| #447 | Search Meter | 34 | 191 | 94 | 20k+ | Output is not escaped | ||
| #448 | Shift8 CDN | 34 | 81 | 25 | 600 | Output is not escaped | ||
| #449 | Social Integration for BlueSky | 34 | 98 | 147 | 700 | Non-prefixed global variable | ||
| #450 | Tidio – Live Chat & AI Chatbots | 34 | 52 | 19 | 80k+ | curl curl setopt |
