PluginScore

Campi Moduli Italiani

Plugin to create useful fields for Italian sites, to be used in the forms produced with Contact Form 7 and WPForms.

v2.3.2GiuseppeUpdated Added 500 installs94% rating
WPFormscodice fiscalecomuni italianicontact form 7firma digitale
34
Score
72
Errors
363
Warnings
+0
Change

Category Scores

Security0
Repo94
Performance100
Maintainability50

Issues to Review

Prioritized issue groups from the latest Plugin Check scan

435 findings

Security

204

9 issue groups

Maintainability

180

13 issue groups

I18n

50

2 issue groups

Repo Compliance

1

1 issue group

WARNINGSecurityUnquoted Complex PlaceholderComplex placeholders used for values in the query string in $wpdb->prepare() will NOT be quoted automagically. Found: %1$s.128
Category
Security
Occurrences
128
Severity
warning

Sample message

Complex placeholders used for values in the query string in $wpdb->prepare() will NOT be quoted automagically. Found: %1$s.

WordPress.DB.PreparedSQLPlaceholders.UnquotedComplexPlaceholder
WARNINGMaintainabilityDirect QueryUse of a direct database call is discouraged.91
Category
Maintainability
Occurrences
91
Severity
warning

Sample message

Use of a direct database call is discouraged.

WordPress.DB.DirectDatabaseQuery.DirectQuery
ERRORI18nText Domain MismatchMismatched text domain. Expected 'campi-moduli-italiani' but got 'contact-form-7'.49
Category
I18n
Occurrences
49
Severity
error

Sample message

Mismatched text domain. Expected 'campi-moduli-italiani' but got 'contact-form-7'.

WordPress.WP.I18n.TextDomainMismatchReference
WARNINGSecurityInput is not sanitizedDetected usage of a non-sanitized input variable: $_GET['order']47
Category
Security
Occurrences
47
Severity
warning

Sample message

Detected usage of a non-sanitized input variable: $_GET['order']

WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
WARNINGMaintainabilityNo CachingDirect database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().37
Category
Maintainability
Occurrences
37
Severity
warning

Sample message

Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().

WordPress.DB.DirectDatabaseQuery.NoCaching
WARNINGMaintainabilitySchema ChangeAttempting a database schema change is discouraged.21
Category
Maintainability
Occurrences
21
Severity
warning

Sample message

Attempting a database schema change is discouraged.

WordPress.DB.DirectDatabaseQuery.SchemaChange
ERRORMaintainabilityMissing direct file access protectionPHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;17
Category
Maintainability
Occurrences
17
Severity
error

Sample message

PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;

missing_direct_file_access_protectionReference
WARNINGSecurityDatabase parameter is not escapedUnescaped parameter $if_statement used in $wpdb->get_results()\n$if_statement assigned unsafely at line 573.12
Category
Security
Occurrences
12
Severity
warning

Sample message

Unescaped parameter $if_statement used in $wpdb->get_results()\n$if_statement assigned unsafely at line 573.

PluginCheck.Security.DirectDB.UnescapedDBParameter
WARNINGSecurityNonce verification recommendedProcessing form data without nonce verification.4
Category
Security
Occurrences
4
Severity
warning

Sample message

Processing form data without nonce verification.

WordPress.Security.NonceVerification.Recommended
WARNINGSecurityInput is not validatedDetected usage of a possibly undefined superglobal array index: $_POST[$this->_args['singular']]. Check that the array index exists before using it.4
Category
Security
Occurrences
4
Severity
warning

Sample message

Detected usage of a possibly undefined superglobal array index: $_POST[$this->_args['singular']]. Check that the array index exists before using it.

WordPress.Security.ValidatedSanitizedInput.InputNotValidated
Show 15 more
WARNINGSecurityRequest data is not unslashed4
Category
Security
Occurrences
4
Severity
warning

Sample message

$_POST[$name] not unslashed before sanitization. Use wp_unslash() or similar

WordPress.Security.ValidatedSanitizedInput.MissingUnslash
WARNINGMaintainabilityNon-prefixed class3
Category
Maintainability
Occurrences
3
Severity
warning

Sample message

Classes declared by a theme/plugin should start with the theme/plugin prefix. Found: "CodiceFiscale".

WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedClassFound
WARNINGSecurityMissing nonce verification3
Category
Security
Occurrences
3
Severity
warning

Sample message

Processing form data without nonce verification.

WordPress.Security.NonceVerification.Missing
WARNINGMaintainabilityDiscouraged PHP function2
Category
Maintainability
Occurrences
2
Severity
warning

Sample message

The use of function set_time_limit() is discouraged

Squiz.PHP.DiscouragedFunctions.Discouraged
WARNINGMaintainabilityerror log print r2
Category
Maintainability
Occurrences
2
Severity
warning

Sample message

print_r() found. Debug code should not normally be used in production.

WordPress.PHP.DevelopmentFunctions.error_log_print_r
ERRORMaintainabilityrename rename2
Category
Maintainability
Occurrences
2
Severity
error

Sample message

rename() is discouraged. Use WP_Filesystem::move() to rename a file.

WordPress.WP.AlternativeFunctions.rename_rename
WARNINGI18nDiscouraged text-domain loading1
Category
I18n
Occurrences
1
Severity
warning

Sample message

load_plugin_textdomain() has been discouraged since WordPress version 4.6. When your plugin is hosted on WordPress.org, you no longer need to manually include this function call for translations under your plugin slug. WordPress will automatically load the translations for you as needed.

PluginCheck.CodeAnalysis.DiscouragedFunctions.load_plugin_textdomainFoundReference
ERRORSecurityDatabase parameter is not escaped1
Category
Security
Occurrences
1
Severity
error

Sample message

Unescaped parameter $sql used in $wpdb->get_row()\n$sql assigned unsafely at line 627.

PluginCheck.Security.DirectDB.UnescapedDBParameter
ERRORSecuritySQL query is not prepared1
Category
Security
Occurrences
1
Severity
error

Sample message

Use placeholders and $wpdb->prepare(); found $sql

WordPress.DB.PreparedSQL.NotPrepared
WARNINGMaintainabilityerror log error log1
Category
Maintainability
Occurrences
1
Severity
warning

Sample message

error_log() found. Debug code should not normally be used in production.

WordPress.PHP.DevelopmentFunctions.error_log_error_log
WARNINGMaintainabilityerror log var dump1
Category
Maintainability
Occurrences
1
Severity
warning

Sample message

var_dump() found. Debug code should not normally be used in production.

WordPress.PHP.DevelopmentFunctions.error_log_var_dump
WARNINGMaintainabilityerror log var export1
Category
Maintainability
Occurrences
1
Severity
warning

Sample message

var_export() found. Debug code should not normally be used in production.

WordPress.PHP.DevelopmentFunctions.error_log_var_export
ERRORMaintainabilityfile system operations rmdir1
Category
Maintainability
Occurrences
1
Severity
error

Sample message

File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: rmdir().

WordPress.WP.AlternativeFunctions.file_system_operations_rmdir
ERRORRepo Complianceoutdated tested upto header1
Category
Repo Compliance
Occurrences
1
Severity
error

Sample message

Tested up to: 6.8 < 7.0. The "Tested up to" value in your plugin is not set to the current version of WordPress. This means your plugin will not show up in searches, as we require plugins to be compatible and documented as tested up to the most recent version of WordPress.

outdated_tested_upto_headerReference
WARNINGMaintainabilityupgrade notice limit1
Category
Maintainability
Occurrences
1
Severity
warning

Sample message

The upgrade notice for "1.1.0" exceeds the limit of 300 characters.

upgrade_notice_limit

External Connections

Potential connections found in static code analysis.

21 domains

Outbound calls

126

External assets

0

Incoming endpoints

18

Notable Domains

jqueryui.com28 · outbound
istat.it11 · outbound
contactform7.com6 · outbound
jquery.org6 · outbound
www1.agenziaentrate.gov.it5 · outbound
api.jqueryui.com4 · outbound

Platform / Reference Domains

wordpress.org36 · platform/reference
github.com9 · platform/reference
w3.org3 · platform/reference
plugins.trac.wordpress.org2 · platform/reference
core.trac.wordpress.org1 · platform/reference
profiles.wordpress.org1 · platform/reference

External Asset Domains

No external asset domains detected.

Incoming Endpoints

wp_ajax_nopriv_the_ajax_hook_comupublic

wp_ajax

wp_ajax_nopriv_the_ajax_hook_infopublic

wp_ajax

wp_ajax_nopriv_the_ajax_hook_provpublic

wp_ajax

wp_ajax_nopriv_the_ajax_hook_targapublic

wp_ajax

Admin AJAX endpoints14
wp_ajax_gcmi_fb_create_filterauthenticated

wp_ajax

wp_ajax_gcmi_fb_create_filter_multiauthenticated

wp_ajax

wp_ajax_gcmi_fb_delete_filterauthenticated

wp_ajax

wp_ajax_gcmi_fb_edit_filterauthenticated

wp_ajax

wp_ajax_gcmi_fb_get_filtersauthenticated

wp_ajax

wp_ajax_gcmi_fb_get_localeauthenticated

wp_ajax

wp_ajax_gcmi_fb_requery_comuniauthenticated

wp_ajax

wp_ajax_gcmi_fb_save_filter_sliceauthenticated

wp_ajax

wp_ajax_gcmi_flamingo_check_codesauthenticated

wp_ajax

wp_ajax_gcmi_show_data_need_update_noticeauthenticated

wp_ajax

wp_ajax_the_ajax_hook_comuauthenticated

wp_ajax

wp_ajax_the_ajax_hook_infoauthenticated

wp_ajax

2 more hidden

Score History

First score snapshot

v2.3.2

34

Latest

Findings
435
Errors
72
Warnings
363
Check
2.0.0

Relationship Map

Author, categories, issues, domains, and nearby plugins.

37 nodes

Related Plugins

DS CF7 Math Captcha

10k+ active installs

100
HTML Editor for Contact Form 7

1k+ active installs

100
Message Bridge for Contact Form 7 and Telegram

10k+ active installs

100
Style Contact Form 7

1k+ active installs

100
Contact Form 7 – Repeatable Fields

6k+ active installs

99
Masks Form Fields

9k+ active installs

99