Shopify-style WooCommerce checkout that lifts conversions. Free express payments (Apple Pay, Google Pay, PayPal) and address autocomplete.
25
Score
1,420
Errors
857
Warnings
+0
Change
Category Scores
Security0
Repo100
Performance96
Maintainability0
Issues to Review
Prioritized issue groups from the latest Plugin Check scan
Maintainability
989
17 issue groups
I18n
770
3 issue groups
Security
471
5 issue groups
ERRORI18nText Domain MismatchMismatched text domain. Expected 'checkoutwc-lite' but got 'cartflows'.751
- Category
- I18n
- Occurrences
- 751
- Severity
- error
Sample message
Mismatched text domain. Expected 'checkoutwc-lite' but got 'cartflows'.
WARNINGMaintainabilityNon-prefixed hook nameHook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "'cfw_thank_you_status_icon_' . $order_status".471
- Category
- Maintainability
- Occurrences
- 471
- Severity
- warning
Sample message
Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "'cfw_thank_you_status_icon_' . $order_status".
ERRORSecurityException output is not escapedAll output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '" {$oParserState->peek()} "'.234
- Category
- Security
- Occurrences
- 234
- Severity
- error
Sample message
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '" {$oParserState->peek()} "'.
WARNINGMaintainabilityNon-prefixed functionFunctions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "cfw_account_password_field_slide".203
- Category
- Maintainability
- Occurrences
- 203
- Severity
- warning
Sample message
Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "cfw_account_password_field_slide".
ERRORSecurityOutput is not escapedAll output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"Since {$package} {$version}: "'.135
- Category
- Security
- Occurrences
- 135
- Severity
- error
Sample message
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"Since {$package} {$version}: "'.
ERRORMaintainabilityMissing direct file access protectionPHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;123
- Category
- Maintainability
- Occurrences
- 123
- Severity
- error
Sample message
PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;
WARNINGMaintainabilityNon-prefixed global variableGlobal variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$Angelleye_PayPal_Express_Checkout_Helper".56
- Category
- Maintainability
- Occurrences
- 56
- Severity
- warning
Sample message
Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$Angelleye_PayPal_Express_Checkout_Helper".
ERRORSecurityUnsafe printing functionAll output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.53
- Category
- Security
- Occurrences
- 53
- Severity
- error
Sample message
All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.
WARNINGSecurityInput is not sanitizedDetected usage of a non-sanitized input variable: $_GET[$return_param_key]44
- Category
- Security
- Occurrences
- 44
- Severity
- warning
Sample message
Detected usage of a non-sanitized input variable: $_GET[$return_param_key]
ERRORMaintainabilitywp function not compatible with requires wpFunction "str_contains()" requires WordPress 5.9.0, but your plugin minimum supported version is WordPress 5.2.0.41
- Category
- Maintainability
- Occurrences
- 41
- Severity
- error
Sample message
Function "str_contains()" requires WordPress 5.9.0, but your plugin minimum supported version is WordPress 5.2.0.
Show 15 moreShow less
WARNINGMaintainabilityNon-prefixed constant16
- Category
- Maintainability
- Occurrences
- 16
- Severity
- warning
Sample message
Global constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "CFW_ACTION_NO_ERROR_SUPPRESSION_BUFFER".
WARNINGMaintainabilityerror log var dump14
- Category
- Maintainability
- Occurrences
- 14
- Severity
- warning
Sample message
var_dump() found. Debug code should not normally be used in production.
ERRORMaintainabilitymysql PDO12
- Category
- Maintainability
- Occurrences
- 12
- Severity
- error
Sample message
Accessing the database directly should be avoided. Please use the $wpdb object and associated functions instead. Found: \PDO.
ERRORMaintainabilitycurl curl setopt11
- Category
- Maintainability
- Occurrences
- 11
- Severity
- error
Sample message
Using cURL functions is highly discouraged. Use wp_remote_get() instead.
ERRORI18nMissing Translators Comment10
- Category
- I18n
- Occurrences
- 10
- Severity
- error
Sample message
A function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.
ERRORMaintainabilityfile system operations fopen9
- Category
- Maintainability
- Occurrences
- 9
- Severity
- error
Sample message
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fopen().
ERRORI18nMissing Arg Domain9
- Category
- I18n
- Occurrences
- 9
- Severity
- error
Sample message
Missing $domain parameter in function call to __().
WARNINGMaintainabilityDirect Query6
- Category
- Maintainability
- Occurrences
- 6
- Severity
- warning
Sample message
Use of a direct database call is discouraged.
WARNINGMaintainabilityNo Caching6
- Category
- Maintainability
- Occurrences
- 6
- Severity
- warning
Sample message
Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().
ERRORMaintainabilityfile system operations fwrite6
- Category
- Maintainability
- Occurrences
- 6
- Severity
- error
Sample message
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fwrite().
WARNINGMaintainabilityerror log trigger error5
- Category
- Maintainability
- Occurrences
- 5
- Severity
- warning
Sample message
trigger_error() found. Debug code should not normally be used in production.
WARNINGSecurityNonce verification recommended5
- Category
- Security
- Occurrences
- 5
- Severity
- warning
Sample message
Processing form data without nonce verification.
ERRORMaintainabilitycurl curl getinfo4
- Category
- Maintainability
- Occurrences
- 4
- Severity
- error
Sample message
Using cURL functions is highly discouraged. Use wp_remote_get() instead.
WARNINGMaintainabilityDynamic hook name3
- Category
- Maintainability
- Occurrences
- 3
- Severity
- warning
Sample message
Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "$hook_name".
ERRORMaintainabilityfile system operations fclose3
- Category
- Maintainability
- Occurrences
- 3
- Severity
- error
Sample message
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fclose().
External Connections
Potential connections found in static code analysis.
Outbound calls
278
External assets
0
Incoming endpoints
22
Notable Domains
checkoutwc.com52 · outbound
smartystreets.com40 · outbound
secure.helpscout.net6 · outbound
demo.checkoutwc.com5 · outbound
php-fig.org4 · outbound
connect.kestrelwp.io2 · outbound
Platform / Reference Domains
github.com58 · platform/reference
w3.org58 · platform/reference
wordpress.org9 · platform/reference
gnu.org5 · platform/reference
core.trac.wordpress.org1 · platform/reference
External Asset Domains
No external asset domains detected.
Incoming Endpoints
/wp-json/checkoutwc/v1/setting/(?P<setting_key>[\S]+)REST
register_rest_route
/wp-json/checkoutwc/v1/settingsREST
register_rest_route
wp_ajax_nopriv_woocommerce_{$this->get_id()}public
wp_ajax
/wp-json/checkoutwc/v1/order-bump-modal-previewREST
register_rest_route
/wp-json/checkoutwc/v1/order-bumpsREST
register_rest_route
/wp-json/checkoutwc/v1/order-bumps/(?P<parent_id>\d+)/variantsREST
register_rest_route
Admin AJAX endpoints8
wp_ajax_woocommerce_{$this->get_id()}authenticated
wp_ajax
wp_ajax_{$js_action}authenticated
wp_ajax
wp_ajax_cfw_generate_settingsauthenticated
wp_ajax
wp_ajax_cfw_license_saveauthenticated
wp_ajax
wp_ajax_cfw_lite_email_opt_inauthenticated
wp_ajax
wp_ajax_cfw_lite_email_opt_in_dismissauthenticated
wp_ajax
wp_ajax_cfw_sendwp_remote_installauthenticated
wp_ajax
wp_ajax_pressmodo_dismiss_noticeauthenticated
wp_ajax
Score History
6 score snapshots
v11.3.1
25
Latest
- Findings
- 2,277
- Errors
- 1,420
- Warnings
- 857
- Check
- 2.1.0
v11.3.0
25
Score
- Findings
- 2,270
- Errors
- 1,416
- Warnings
- 854
- Check
- 2.0.0
| Scan | Score | Findings | Errors | Warnings | Plugin | Check |
|---|---|---|---|---|---|---|
| Latest | 25 | 2,277 | 1,420 | 857 | v11.3.1 | 2.1.0 |
| 25 | 2,270 | 1,416 | 854 | v11.3.0 | 2.0.0 |
Relationship Map
Author, categories, issues, domains, and nearby plugins.
Loading map
PluginAuthorCategoryIssueDomainRelated
Relationship links
Author
Category
Issue
Domain
Related
Yoast SEO – Advanced SEO with real-time guidance and built-in AI24 scoreContact Form 769 scoreElementor Website Builder – more than just a page builder39 scoreLiteSpeed Cache35 scoreWooCommerce22 scoreSite Kit by Google – Analytics, Search Console, AdSense, Speed25 scoreWordfence Security – Firewall, Malware Scan, and Login Security21 scoreAkismet Anti-spam: Spam Protection35 scoreJetpack – WP Security, Backup, Speed, & Growth21 scoreReally Simple Security – Simple and Performant Security (formerly Really Simple SSL)19 scoreAdvanced Custom Fields (ACF®)23 scoreCheckout Field Editor (Checkout Manager) for WooCommerce41 scoreCart Abandonment Recovery for WooCommerce – Recover Lost Sales with Automated Emails26 scoreCheckout Field Manager (Checkout Manager) for WooCommerce43 score
Author
Category
Issue
Domain
Related
Yoast SEO – Advanced SEO with real-time guidance and built-in AI24 scoreContact Form 769 scoreElementor Website Builder – more than just a page builder39 scoreLiteSpeed Cache35 scoreWooCommerce22 scoreSite Kit by Google – Analytics, Search Console, AdSense, Speed25 scoreWordfence Security – Firewall, Malware Scan, and Login Security21 scoreAkismet Anti-spam: Spam Protection35 scoreJetpack – WP Security, Backup, Speed, & Growth21 scoreReally Simple Security – Simple and Performant Security (formerly Really Simple SSL)19 scoreAdvanced Custom Fields (ACF®)23 scoreCheckout Field Editor (Checkout Manager) for WooCommerce41 scoreCart Abandonment Recovery for WooCommerce – Recover Lost Sales with Automated Emails26 scoreCheckout Field Manager (Checkout Manager) for WooCommerce43 score
Related Plugins
Trust Badges – Payment Icons & Secure Checkout Seals for WooCommerce
400 active installs
100
Additional Terms Lite for WooCommerce
2k+ active installs
99
One Click Upsell Funnel for Woocommerce
1k+ active installs
99
Shop as Client for WooCommerce – Manual, Phone & Email Orders
600 active installs
99
Recapture for Easy Digital Downloads
600 active installs
99
Ship to a Different Address Checked/Unchecked for WooCommerce
600 active installs
99