plugin_updater_detected
plugin updater detected
The plugin appears to include its own update or modification mechanism.
Why It Shows Up
Plugin Check found updater code or code that modifies plugin files outside the normal WordPress.org update flow.
Why It Matters
Custom update mechanisms can bypass repository review, surprise site owners, or change executable code after installation.
How to Fix
- Remove custom updater code from WordPress.org releases when it is not needed.
- Do not rewrite plugin source files at runtime.
- If remote updates are intentional outside WordPress.org, document the trust model and protect it with strong validation.
Affected Plugins
| Rank | Plugin | Score | Errors | Warnings | Installs | Added | Updated | Top Issue |
|---|---|---|---|---|---|---|---|---|
| #551 | RPS Image Gallery | 35 | 88 | 16 | 800 | Output is not escaped | ||
| #552 | Simple History – Track, Log, and Audit WordPress Changes | 35 | 32 | 122 | 300k+ | Non-prefixed global variable | ||
| #553 | SiteOrigin CSS | 35 | 61 | 84 | 100k+ | Not In Footer | ||
| #554 | WP All Export – Drag & Drop Export to Any Custom CSV, XML & Excel | 35 | 41 | 10 | 100k+ | wp function not compatible with requires wp | ||
| #555 | WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets | 35 | 35 | 20 | 100k+ | Missing direct file access protection | ||
| #556 | WP Store Locator | 35 | 26 | 14 | 50k+ | wp function not compatible with requires wp | ||
| #557 | Dynamic Copyright Year | 36 | 972 | 43 | 800 | Output is not escaped | ||
| #558 | HTTP Requests Manager | 36 | 98 | 90 | 1k+ | Output is not escaped | ||
| #559 | Lara's Google Analytics (GA4) | 36 | 303 | 57 | 9k+ | Unsafe printing function | ||
| #560 | ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution | 36 | 63 | 667 | 100k+ | Non-prefixed global variable | ||
| #561 | Wppao Sitemap | 36 | 128 | 21 | 9k+ | Output is not escaped | ||
| #562 | avalex – Automatisch sichere Rechtstexte | 37 | 25 | 85 | 1k+ | Direct Query | ||
| #563 | Better Click To Share – Shareable Quote Boxes for X (Twitter) | 37 | 170 | 59 | 6k+ | Unsafe printing function | ||
| #564 | Customize WordPress Emails and Alerts – Better Notifications for WP | 37 | 64 | 47 | 30k+ | Missing Arg Domain | ||
| #565 | Disclaimer Popup | 37 | 313 | 53 | 1k+ | Text Domain Mismatch | ||
| #566 | WPForce Logout – WordPress User Login Logout Management Plugin | 37 | 567 | 32 | 8k+ | Output is not escaped | ||
| #567 | ReCaptcha Integration for WordPress | 37 | 60 | 66 | 9k+ | Output is not escaped | ||
| #568 | TopNewsWp – Display Tikcer News, RSS Feed Widget and Many More | 37 | 878 | 59 | 800 | Output is not escaped | ||
| #569 | WPO365 | MICROSOFT 365 GRAPH MAILER | 37 | 112 | 83 | 10k+ | Text Domain Mismatch | ||
| #570 | Admin Tools | 38 | 189 | 10 | 3k+ | Unsafe printing function | ||
| #571 | Goal Tracker – Custom Event Tracking for GA4 | 38 | 541 | 25 | 2k+ | Output is not escaped | ||
| #572 | CAOS | Host Google Analytics Locally | 38 | 124 | 44 | 10k+ | Output is not escaped | ||
| #573 | jQuery Pin It Button for Images | 38 | 129 | 36 | 10k+ | Output is not escaped | ||
| #574 | MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites | 38 | 3 | 136 | 700k+ | Non-prefixed hook name | ||
| #575 | Popular Posts by Webline | 38 | 256 | 8 | 1k+ | Output is not escaped | ||
| #576 | Broadcast | 38 | 21 | 107 | 1k+ | Direct Query | ||
| #577 | White Label – WordPress Custom Admin, Custom Login Page, and Custom Dashboard | 38 | 205 | 31 | 10k+ | Output is not escaped | ||
| #578 | Wholesale for WooCommerce | 38 | 541 | 22 | 1k+ | Output is not escaped | ||
| #579 | Events Manager – Zoom Integration | 39 | 141 | 43 | 700 | Output is not escaped | ||
| #580 | Flexible Posts Widget | 41 | 136 | 33 | 8k+ | Output is not escaped | ||
| #581 | Simple Lightbox | 41 | 21 | 48 | 100k+ | Nonce verification recommended | ||
| #582 | WP Club Manager – WordPress Sports Club Plugin | 44 | 171 | 682 | 600 | Non-prefixed global variable | ||
| #583 | Jetpack Search | 45 | 925 | 426 | 5k+ | Text Domain Mismatch | ||
| #584 | Utimate Kit ( Styler ) for WPForms | 45 | 240 | 69 | 20k+ | Missing Arg Domain | ||
| #585 | Jetpack Social | 48 | 829 | 254 | 30k+ | Text Domain Mismatch | ||
| #586 | Easy Updates Manager | 48 | 13 | 182 | 300k+ | Non-prefixed global variable | ||
| #587 | Easy Property Listings | 49 | 60 | 66 | 5k+ | wp function not compatible with requires wp | ||
| #588 | Booster for WPForms | 50 | 79 | 45 | 800 | Text Domain Mismatch | ||
| #589 | User Activity Tracking and Log | 50 | 30 | 263 | 3k+ | Non-prefixed global variable | ||
| #590 | Automattic For Agencies Client | 53 | 249 | 184 | 20k+ | Text Domain Mismatch | ||
| #591 | Connect Contact Form 7 and Mailchimp | 53 | 290 | 52 | 40k+ | Text Domain Mismatch | ||
| #592 | Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder | 55 | 54 | 692 | 700k+ | Non-prefixed hook name | ||
| #593 | Themeflection Numbers – Number Counter and Animated Numbers | 55 | 224 | 73 | 3k+ | Text Domain Mismatch | ||
| #594 | WP Ultimate Review | 55 | 23 | 381 | 70k+ | Non-prefixed global variable | ||
| #595 | Elementor Beta (Developer Edition) | 57 | 36 | 32 | 30k+ | Output is not escaped | ||
| #596 | Gravity PDF | 57 | 116 | 152 | 20k+ | Non-prefixed global variable | ||
| #597 | Disabler | 64 | 212 | 38 | 900 | Text Domain Mismatch | ||
| #598 | onOffice for WP-Websites | 67 | 5 | 507 | 1k+ | Non-prefixed global variable | ||
| #599 | Free Assets Library – Openverse/Pixabay 600+ Million Images | 68 | 44 | 36 | 4k+ | Text Domain Mismatch | ||
| #600 | Plugin Groups | 73 | 16 | 12 | 1k+ | Non Singular String Literal Domain |
