Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots

Real-time messaging and chat rooms for WordPress ecosystem: private conversations, public and private chat rooms, video & audio calls, and more.

v2.15.14wordplusUpdated Added 10k+ installs96% rating86% support resolved
22
Score
1,607
Errors
2,018
Warnings
+0
Change

Category Scores

Security0
Repo90
Performance84
Maintainability0

Issues to Review

Prioritized issue groups from the latest Plugin Check scan

3,625 findings

Security

1,849

12 issue groups

Maintainability

1,369

12 issue groups

I18n

155

1 issue group

WARNINGMaintainabilityDirect QueryUse of a direct database call is discouraged.535
Category
Maintainability
Occurrences
535
Severity
warning

Sample message

Use of a direct database call is discouraged.

ERRORSecuritySQL query is not preparedUse placeholders and $wpdb->prepare(); found $activity_sql492
Category
Security
Occurrences
492
Severity
error

Sample message

Use placeholders and $wpdb->prepare(); found $activity_sql

WARNINGMaintainabilityNo CachingDirect database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().466
Category
Maintainability
Occurrences
466
Severity
warning

Sample message

Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().

WARNINGSecurityInterpolated SQL is not preparedUse placeholders and $wpdb->prepare(); found interpolated variable $base at "$base AND {$wpdb->posts}.post_type = %s ORDER BY meta_key ASC LIMIT %d"342
Category
Security
Occurrences
342
Severity
warning

Sample message

Use placeholders and $wpdb->prepare(); found interpolated variable $base at "$base AND {$wpdb->posts}.post_type = %s ORDER BY meta_key ASC LIMIT %d"

ERRORSecurityOutput is not escapedAll output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"Since $package $version: "'.262
Category
Security
Occurrences
262
Severity
error

Sample message

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"Since $package $version: "'.

ERRORSecurityDatabase parameter is not escapedUnescaped parameter $bulk_jobs_table used in $wpdb->get_row()\n$bulk_jobs_table assigned unsafely at line 133.249
Category
Security
Occurrences
249
Severity
error

Sample message

Unescaped parameter $bulk_jobs_table used in $wpdb->get_row()\n$bulk_jobs_table assigned unsafely at line 133.

WARNINGSecurityDatabase parameter is not escapedUnescaped parameter $ai_usage_table used in $wpdb->get_col()\n$ai_usage_table assigned unsafely at line 1948.158
Category
Security
Occurrences
158
Severity
warning

Sample message

Unescaped parameter $ai_usage_table used in $wpdb->get_col()\n$ai_usage_table assigned unsafely at line 1948.

ERRORI18nMissing Translators CommentA function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.155
Category
I18n
Occurrences
155
Severity
error

Sample message

A function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.

ERRORSecurityException output is not escapedAll output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"$name not found on class"'.154
Category
Security
Occurrences
154
Severity
error

Sample message

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"$name not found on class"'.

WARNINGMaintainabilityNon-prefixed hook nameHook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "after_wcfm_bpbm_messages".94
Category
Maintainability
Occurrences
94
Severity
warning

Sample message

Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "after_wcfm_bpbm_messages".

Show 15 more
WARNINGMaintainabilityNon-prefixed global variable68
Category
Maintainability
Occurrences
68
Severity
warning

Sample message

Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$__composer_autoload_files".

WARNINGSecurityRequest data is not unslashed50
Category
Security
Occurrences
50
Severity
warning

Sample message

$_GET['bm-unsubscribe'] not unslashed before sanitization. Use wp_unslash() or similar

WARNINGSecurityNonce verification recommended43
Category
Security
Occurrences
43
Severity
warning

Sample message

Processing form data without nonce verification.

ERRORMaintainabilityunlink unlink43
Category
Maintainability
Occurrences
43
Severity
error

Sample message

unlink() is discouraged. Use wp_delete_file() to delete a file.

WARNINGSecurityInput is not sanitized42
Category
Security
Occurrences
42
Severity
warning

Sample message

Detected usage of a non-sanitized input variable: $_GET['plugin']

ERRORMaintainabilityMissing direct file access protection34
Category
Maintainability
Occurrences
34
Severity
error

Sample message

PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;

ERRORMaintainabilitywp function not compatible with requires wp28
Category
Maintainability
Occurrences
28
Severity
error

Sample message

Function "wp_register_ability()" requires WordPress 6.9.0, but your plugin minimum supported version is WordPress 5.9.0.

ERRORMaintainabilityparse url parse url26
Category
Maintainability
Occurrences
26
Severity
error

Sample message

parse_url() is discouraged because of inconsistency in the output across PHP versions; use wp_parse_url() instead.

WARNINGMaintainabilityDiscouraged PHP function22
Category
Maintainability
Occurrences
22
Severity
warning

Sample message

The use of function ini_set() is discouraged

WARNINGSecurityReplacements Wrong Number21
Category
Security
Occurrences
21
Severity
warning

Sample message

Incorrect number of replacements passed to $wpdb->prepare(). Found 1 replacement parameters, expected 2.

ERRORMaintainabilityfile system operations fclose20
Category
Maintainability
Occurrences
20
Severity
error

Sample message

File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fclose().

ERRORSecurityUnsafe printing function19
Category
Security
Occurrences
19
Severity
error

Sample message

All output should be run through an escaping function (like echo esc_html_x() or echo esc_attr_x()), found '_ex'.

WARNINGMaintainabilityABSPATHDetected17
Category
Maintainability
Occurrences
17
Severity
warning

Sample message

Writing files using ABSPATH may be problematic. Consider using wp_upload_dir() instead if storing user data or generated files.

WARNINGSecurityMissing nonce verification17
Category
Security
Occurrences
17
Severity
warning

Sample message

Processing form data without nonce verification.

WARNINGMaintainabilitySchema Change16
Category
Maintainability
Occurrences
16
Severity
warning

Sample message

Attempting a database schema change is discouraged.

External Connections

Potential connections found in static code analysis.

37 domains

Outbound calls

261

External assets

0

Incoming endpoints

39

Notable Domains

tools.ietf.org61 · outbound
php.net31 · outbound
datatracker.ietf.org27 · outbound
php-fig.org14 · outbound
bugs.php.net8 · outbound
3v4l.org7 · outbound

Platform / Reference Domains

github.com58 · platform/reference
w3.org1 · platform/reference

External Asset Domains

No external asset domains detected.

Incoming Endpoints

/wp-json/better-messages/v1/admin/ai/botsREST

register_rest_route

/wp-json/better-messages/v1/admin/ai/bots/(?P<id>\d+)REST

register_rest_route

/wp-json/better-messages/v1/admin/ai/bots/(?P<id>\d+)/conversationsREST

register_rest_route

/wp-json/better-messages/v1/admin/ai/bots/(?P<id>\d+)/cleanupREST

register_rest_route

/wp-json/better-messages/v1/admin/ai/bots/(?P<id>\d+)/conversations/(?P<thread_id>\d+)REST

register_rest_route

/wp-json/better-messages/v1/admin/ai/bots/(?P<id>\d+)/errorsREST

register_rest_route

Admin AJAX endpoints1
wp_ajax_buddyboss_theme_get_header_unread_messagesauthenticated

wp_ajax

Score History

2 score snapshots

+0
1007550250Jun 20, 2026, 02:39 PM UTC Score 22/100 Plugin v2.15.13 Plugin Check 2.0.0 1,604 errors, 2,019 warningsJun 26, 2026, 04:38 AM UTC Score 22/100 Plugin v2.15.14 Plugin Check 2.0.0 1,607 errors, 2,018 warningsJun 20, 2026Jun 26, 2026

v2.15.14

22

Latest

Findings
3,625
Errors
1,607
Warnings
2,018
Check
2.0.0

v2.15.13

22

Score

Findings
3,623
Errors
1,604
Warnings
2,019
Check
2.0.0

Relationship Map

Author, categories, issues, domains, and nearby plugins.

36 nodes

Related Plugins