PluginScore

Avif Express

Autogenerate avif image on image upload and serve autogenerated Avif images instead of jpeg/png to browsers that supports Avif.

v2025.08.29Pijush GuptaUpdated Added 400 installs76% rating
AVIFimagesperformance
35
Score
26
Errors
167
Warnings
+0
Change

Category Scores

Security0
Repo75
Performance100
Maintainability75

Issues to Review

Prioritized issue groups from the latest Plugin Check scan

193 findings

Security

164

4 issue groups

Maintainability

21

13 issue groups

I18n

4

2 issue groups

Supply Chain

2

1 issue group

WARNINGSecurityInput is not validatedDetected usage of a possibly undefined superglobal array index: $_POST['apiKey']. Check that the array index exists before using it.55
Category
Security
Occurrences
55
Severity
warning

Sample message

Detected usage of a possibly undefined superglobal array index: $_POST['apiKey']. Check that the array index exists before using it.

WordPress.Security.ValidatedSanitizedInput.InputNotValidated
WARNINGSecurityRequest data is not unslashed$_POST['apiKey'] not unslashed before sanitization. Use wp_unslash() or similar54
Category
Security
Occurrences
54
Severity
warning

Sample message

$_POST['apiKey'] not unslashed before sanitization. Use wp_unslash() or similar

WordPress.Security.ValidatedSanitizedInput.MissingUnslash
WARNINGSecurityInput is not sanitizedDetected usage of a non-sanitized input variable: $_POST['avife_nonce']44
Category
Security
Occurrences
44
Severity
warning

Sample message

Detected usage of a non-sanitized input variable: $_POST['avife_nonce']

WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
ERRORSecurityOutput is not escapedAll output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$assetPath'.11
Category
Security
Occurrences
11
Severity
error

Sample message

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '$assetPath'.

WordPress.Security.EscapeOutput.OutputNotEscapedReference
WARNINGMaintainabilityNon-prefixed constantGlobal constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "IS_GD_AVIF".4
Category
Maintainability
Occurrences
4
Severity
warning

Sample message

Global constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "IS_GD_AVIF".

WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedConstantFound
WARNINGMaintainabilityNon-prefixed global variableGlobal variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$bg_converter".4
Category
Maintainability
Occurrences
4
Severity
warning

Sample message

Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$bg_converter".

WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound
WARNINGMaintainabilityerror log print rprint_r() found. Debug code should not normally be used in production.2
Category
Maintainability
Occurrences
2
Severity
warning

Sample message

print_r() found. Debug code should not normally be used in production.

WordPress.PHP.DevelopmentFunctions.error_log_print_r
ERRORMaintainabilityparse url parse urlparse_url() is discouraged because of inconsistency in the output across PHP versions; use wp_parse_url() instead.2
Category
Maintainability
Occurrences
2
Severity
error

Sample message

parse_url() is discouraged because of inconsistency in the output across PHP versions; use wp_parse_url() instead.

WordPress.WP.AlternativeFunctions.parse_url_parse_url
ERRORI18nNon Singular String Literal DomainThe $domain parameter must be a single text string literal. Found: AVIFE_TEXT_DOMAIN2
Category
I18n
Occurrences
2
Severity
error

Sample message

The $domain parameter must be a single text string literal. Found: AVIFE_TEXT_DOMAIN

WordPress.WP.I18n.NonSingularStringLiteralDomainReference
ERRORI18nNon Singular String Literal TextThe $text parameter must be a single text string literal. Found: AVIFE_ADMIN_MENU_NAME2
Category
I18n
Occurrences
2
Severity
error

Sample message

The $text parameter must be a single text string literal. Found: AVIFE_ADMIN_MENU_NAME

WordPress.WP.I18n.NonSingularStringLiteralTextReference
Show 12 more
ERRORSupply ChainHidden files included2
Category
Supply Chain
Occurrences
2
Severity
error

Sample message

Hidden files are not permitted.

hidden_files
ERRORMaintainabilityNot Allowed1
Category
Maintainability
Occurrences
1
Severity
error

Sample message

Use of heredoc syntax (<<<) is not allowed; use standard strings or inline HTML instead

PluginCheck.CodeAnalysis.Heredoc.NotAllowed
WARNINGMaintainabilityDiscouraged PHP function1
Category
Maintainability
Occurrences
1
Severity
warning

Sample message

The use of function set_time_limit() is discouraged

Squiz.PHP.DiscouragedFunctions.Discouraged
WARNINGMaintainabilityNon-prefixed function1
Category
Maintainability
Occurrences
1
Severity
warning

Sample message

Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: &quot;initiate_plugin&quot;.

WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedFunctionFound
WARNINGMaintainabilityerror log error log1
Category
Maintainability
Occurrences
1
Severity
warning

Sample message

error_log() found. Debug code should not normally be used in production.

WordPress.PHP.DevelopmentFunctions.error_log_error_log
ERRORMaintainabilityfile system operations fclose1
Category
Maintainability
Occurrences
1
Severity
error

Sample message

File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fclose().

WordPress.WP.AlternativeFunctions.file_system_operations_fclose
ERRORMaintainabilityfile system operations fopen1
Category
Maintainability
Occurrences
1
Severity
error

Sample message

File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fopen().

WordPress.WP.AlternativeFunctions.file_system_operations_fopen
ERRORMaintainabilityunlink unlink1
Category
Maintainability
Occurrences
1
Severity
error

Sample message

unlink() is discouraged. Use wp_delete_file() to delete a file.

WordPress.WP.AlternativeFunctions.unlink_unlink
WARNINGMaintainabilitymismatched plugin name1
Category
Maintainability
Occurrences
1
Severity
warning

Sample message

Plugin name "Avif Express" is different from the name declared in plugin header "AVIF Express".

mismatched_plugin_nameReference
ERRORMaintainabilityMissing direct file access protection1
Category
Maintainability
Occurrences
1
Severity
error

Sample message

PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;

missing_direct_file_access_protectionReference
ERRORRepo Complianceoutdated tested upto header1
Category
Repo Compliance
Occurrences
1
Severity
error

Sample message

Tested up to: 6.8 < 7.0. The "Tested up to" value in your plugin is not set to the current version of WordPress. This means your plugin will not show up in searches, as we require plugins to be compatible and documented as tested up to the most recent version of WordPress.

outdated_tested_upto_headerReference
ERRORRepo Complianceplugin header no license1
Category
Repo Compliance
Occurrences
1
Severity
error

Sample message

Missing "License" in Plugin Header. Please update your Plugin Header with a valid GPLv2 (or later) compatible license.

plugin_header_no_licenseReference

External Connections

Potential connections found in static code analysis.

20 domains

Outbound calls

132

External assets

0

Incoming endpoints

42

Notable Domains

php.net10 · outbound
developer.mozilla.org6 · outbound
bugs.php.net4 · outbound
gsnedders.com2 · outbound
php-fig.org2 · outbound
aavoya.co1 · outbound

Platform / Reference Domains

github.com55 · platform/reference
w3.org40 · platform/reference
api.wordpress.org1 · platform/reference
dev.w3.org1 · platform/reference
developer.wordpress.org1 · platform/reference
wordpress.org1 · platform/reference

External Asset Domains

No external asset domains detected.

Incoming Endpoints

wp_ajax_nopriv_public

wp_ajax

Admin AJAX endpoints41
wp_ajax_ajaxConvertRemainingauthenticated

wp_ajax

wp_ajax_ajaxCountMediaauthenticated

wp_ajax

wp_ajax_ajaxDeleteAllauthenticated

wp_ajax

wp_ajax_ajaxDeleteLogFileauthenticated

wp_ajax

wp_ajax_ajaxGetApiKeyauthenticated

wp_ajax

wp_ajax_ajaxGetAutoConvtStatusauthenticated

wp_ajax

wp_ajax_ajaxGetBackgroudConvauthenticated

wp_ajax

wp_ajax_ajaxGetBackgroundConvEventauthenticated

wp_ajax

wp_ajax_ajaxGetComSpeedauthenticated

wp_ajax

wp_ajax_ajaxGetConversionEngineauthenticated

wp_ajax

wp_ajax_ajaxGetCurrentThemeauthenticated

wp_ajax

wp_ajax_ajaxGetEnableLoggingauthenticated

wp_ajax

29 more hidden

Score History

First score snapshot

v2025.08.29

35

Latest

Findings
193
Errors
26
Warnings
167
Check
2.0.0

Relationship Map

Author, categories, issues, domains, and nearby plugins.

35 nodes

Related Plugins

DietPress

2k+ active installs

100
Disable Emojis (GDPR friendly)

60k+ active installs

100
Disable Lazy Load

10k+ active installs

100
Disable Responsive Images Complete

2k+ active installs

100
Embed Optimizer

50k+ active installs

100
Image Placeholders

60k+ active installs

100