Create custom product labels and sale badges for WooCommerce products to highlight offers and promotions.
Category Scores
Top Issues by Category
maintainability64
security58
i18n13
performance1
repo_compliance1
Issues Details
138 issues found in latest scan
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$product'.
date() is affected by runtime timezone changes which can cause date/time to be incorrectly displayed. Use gmdate() instead.
Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().
Unescaped parameter $productID used in $wpdb->get_col()\n$productID assigned unsafely at line 1309.
SQL wildcards for a LIKE query should be passed in through a replacement parameter. Found: LIKE '%.
Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "active_plugins".
Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "$post_type . '_labels'".
PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;
Use placeholders and $wpdb->prepare(); found interpolated variable $productID at "SELECT ID FROM {$wpdb->prefix}posts WHERE post_status = 'publish' AND post_parent IN ($productID) AND post_type = 'product_variation'"
Simple placeholders should not be quoted in the query string in $wpdb->prepare(). Found: '%s'.
Detected usage of meta_query, possible slow query.
Detected usage of tax_query, possible slow query.
Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$badge".
In footer ($in_footer) is not set explicitly wp_enqueue_script; It is recommended to load scripts in the footer. Please set this value to `true` to load it in the footer, or explicitly `false` if it should be loaded in the header.
The $context parameter must be a single text string literal. Found: $post_type
load_plugin_textdomain() has been discouraged since WordPress version 4.6. When your plugin is hosted on WordPress.org, you no longer need to manually include this function call for translations under your plugin slug. WordPress will automatically load the translations for you as needed.
The parameter "['taxonomy' => 'product_cat', 'hide_empty' => false, 'fields' => 'id=>name']" at position #2 of get_terms() has been deprecated since WordPress version 4.5.0. Instead do not pass the parameter.
Resource version not set in call to wp_enqueue_script(). This means new versions of the script may not always be loaded due to browser caching.
Using exclusionary parameters, like post__not_in, in calls to get_posts() should be done with caution, see https://wpvip.com/documentation/performance-improvements-by-removing-usage-of-post__not_in/ for more information.
Plugin name "Product Labels For Woocommerce (Sale Badges)" is different from the name declared in plugin header "Acowebs Product Labels For Woocommerce".
Missing "License" in Plugin Header. Please update your Plugin Header with a valid GPLv2 (or later) compatible license.
| Code | Type | Message | Count |
|---|---|---|---|
| WordPress.Security.EscapeOutput.OutputNotEscaped | ERROR | All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$product'. | 29 |
| WordPress.DateTime.RestrictedFunctions.date_date | ERROR | date() is affected by runtime timezone changes which can cause date/time to be incorrectly displayed. Use gmdate() instead. | 16 |
| WordPress.DB.DirectDatabaseQuery.DirectQuery | WARNING | Use of a direct database call is discouraged. | 11 |
| WordPress.DB.DirectDatabaseQuery.NoCaching | WARNING | Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete(). | 11 |
| WordPress.WP.I18n.MissingArgDomain | ERROR | Missing $domain parameter in function call to __(). | 10 |
| WordPress.DB.PreparedSQLPlaceholders.UnescapedLiteral | ERROR | Found unescaped literal "%" character. | 7 |
| PluginCheck.Security.DirectDB.UnescapedDBParameter | ERROR | Unescaped parameter $productID used in $wpdb->get_col()\n$productID assigned unsafely at line 1309. | 6 |
| WordPress.DB.PreparedSQLPlaceholders.LikeWildcardsInQuery | ERROR | SQL wildcards for a LIKE query should be passed in through a replacement parameter. Found: LIKE '%. | 6 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound | WARNING | Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "active_plugins". | 6 |
| WordPress.DB.PreparedSQL.NotPrepared | ERROR | Use placeholders and $wpdb->prepare(); found $prodvalues | 4 |
| WordPress.NamingConventions.PrefixAllGlobals.DynamicHooknameFound | WARNING | Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "$post_type . '_labels'". | 4 |
| missing_direct_file_access_protection | ERROR | PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit; | 4 |
| WordPress.DB.PreparedSQL.InterpolatedNotPrepared | WARNING | Use placeholders and $wpdb->prepare(); found interpolated variable $productID at "SELECT ID FROM {$wpdb->prefix}posts WHERE post_status = 'publish' AND post_parent IN ($productID) AND post_type = 'product_variation'" | 3 |
| WordPress.DB.PreparedSQLPlaceholders.QuotedSimplePlaceholder | ERROR | Simple placeholders should not be quoted in the query string in $wpdb->prepare(). Found: '%s'. | 3 |
| WordPress.DB.SlowDBQuery.slow_db_query_meta_query | WARNING | Detected usage of meta_query, possible slow query. | 3 |
| WordPress.DB.SlowDBQuery.slow_db_query_tax_query | WARNING | Detected usage of tax_query, possible slow query. | 2 |
| WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound | WARNING | Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$badge". | 2 |
| WordPress.WP.EnqueuedResourceParameters.NotInFooter | WARNING | In footer ($in_footer) is not set explicitly wp_enqueue_script; It is recommended to load scripts in the footer. Please set this value to `true` to load it in the footer, or explicitly `false` if it should be loaded in the header. | 2 |
| WordPress.WP.I18n.NonSingularStringLiteralContext | ERROR | The $context parameter must be a single text string literal. Found: $post_type | 2 |
| PluginCheck.CodeAnalysis.DiscouragedFunctions.load_plugin_textdomainFound | WARNING | load_plugin_textdomain() has been discouraged since WordPress version 4.6. When your plugin is hosted on WordPress.org, you no longer need to manually include this function call for translations under your plugin slug. WordPress will automatically load the translations for you as needed. | 1 |
| WordPress.WP.DeprecatedParameters.Get_termsParam2Found | ERROR | The parameter "['taxonomy' => 'product_cat', 'hide_empty' => false, 'fields' => 'id=>name']" at position #2 of get_terms() has been deprecated since WordPress version 4.5.0. Instead do not pass the parameter. | 1 |
| WordPress.WP.EnqueuedResourceParameters.MissingVersion | WARNING | Resource version not set in call to wp_enqueue_script(). This means new versions of the script may not always be loaded due to browser caching. | 1 |
| WordPressVIPMinimum.Performance.WPQueryParams.PostNotIn_post__not_in | WARNING | Using exclusionary parameters, like post__not_in, in calls to get_posts() should be done with caution, see https://wpvip.com/documentation/performance-improvements-by-removing-usage-of-post__not_in/ for more information. | 1 |
| mismatched_plugin_name | WARNING | Plugin name "Product Labels For Woocommerce (Sale Badges)" is different from the name declared in plugin header "Acowebs Product Labels For Woocommerce". | 1 |
| plugin_header_no_license | ERROR | Missing "License" in Plugin Header. Please update your Plugin Header with a valid GPLv2 (or later) compatible license. | 1 |
Latest Snapshot
Findings
138
Errors
90
Warnings
48
Score History
First score snapshot
First scan completed Jun 20, 2026
v1.5.14 · Plugin Check 2.0.0 · Model 2026.06-mvp-static-v2
Jun 20, 2026
v1.5.14
36
Latest
- Findings
- 138
- Errors
- 90
- Warnings
- 48
- Plugin Check
- 2.0.0
- Model
- 2026.06-mvp-static-v2
| Scan | Score | Findings | Errors | Warnings | Plugin | Plugin Check | Model |
|---|---|---|---|---|---|---|---|
| Jun 20, 2026Latest | 36 | 138 | 90 | 48 | v1.5.14 | 2.0.0 | 2026.06-mvp-static-v2 |