Contact Form by Supsystic

Contact Form Builder with drag-and-drop editor to create responsive, mobile ready contact forms in a second. Custom fields and contact form templates

v1.8.1supsysticUpdated Added 6k+ installs94% rating
24
Score
1,913
Errors
633
Warnings
+0
Change

Category Scores

Security0
Repo94
Performance100
Maintainability0

Issues to Review

Prioritized issue groups from the latest Plugin Check scan

2,546 findings

Security

1,107

9 issue groups

I18n

825

5 issue groups

Maintainability

570

11 issue groups

ERRORI18nNon Singular String Literal DomainThe $domain parameter must be a single text string literal. Found: CFS_LANG_CODE700
Category
I18n
Occurrences
700
Severity
error

Sample message

The $domain parameter must be a single text string literal. Found: CFS_LANG_CODE

ERRORSecurityOutput is not escapedAll output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"Can't open {$db_file}\n"'.506
Category
Security
Occurrences
506
Severity
error

Sample message

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"Can't open {$db_file}\n"'.

ERRORSecurityException output is not escapedAll output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"Expected endblock for block '$name' (but %s given)"'.243
Category
Security
Occurrences
243
Severity
error

Sample message

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"Expected endblock for block '$name' (but %s given)"'.

ERRORSecurityUnsafe printing functionAll output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.235
Category
Security
Occurrences
235
Severity
error

Sample message

All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.

WARNINGMaintainabilityDirect QueryUse of a direct database call is discouraged.129
Category
Maintainability
Occurrences
129
Severity
warning

Sample message

Use of a direct database call is discouraged.

WARNINGMaintainabilityNo CachingDirect database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().109
Category
Maintainability
Occurrences
109
Severity
warning

Sample message

Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().

WARNINGMaintainabilityNon-prefixed classClasses declared by a theme/plugin should start with the theme/plugin prefix. Found: "Mobile_Detect".79
Category
Maintainability
Occurrences
79
Severity
warning

Sample message

Classes declared by a theme/plugin should start with the theme/plugin prefix. Found: "Mobile_Detect".

WARNINGMaintainabilityNon-prefixed constantGlobal constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "CFS_ADMIN".75
Category
Maintainability
Occurrences
75
Severity
warning

Sample message

Global constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "CFS_ADMIN".

WARNINGMaintainabilityNon-prefixed global variableGlobal variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$attr".66
Category
Maintainability
Occurrences
66
Severity
warning

Sample message

Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$attr".

ERRORI18nMissing Translators CommentA function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.65
Category
I18n
Occurrences
65
Severity
error

Sample message

A function call to __() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.

Show 15 more
ERRORMaintainabilityMissing direct file access protection37
Category
Maintainability
Occurrences
37
Severity
error

Sample message

PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;

WARNINGMaintainabilityNon-prefixed function34
Category
Maintainability
Occurrences
34
Severity
warning

Sample message

Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "_recaptcha_aes_encrypt".

WARNINGSecurityRequest data is not unslashed34
Category
Security
Occurrences
34
Severity
warning

Sample message

$_COOKIE[$name] not unslashed before sanitization. Use wp_unslash() or similar

ERRORI18nMissing Arg Domain32
Category
I18n
Occurrences
32
Severity
error

Sample message

Missing $domain parameter in function call to __().

WARNINGSecurityInput is not sanitized29
Category
Security
Occurrences
29
Severity
warning

Sample message

Detected usage of a non-sanitized input variable: $_GET[$name]

WARNINGSecurityUnquoted Complex Placeholder18
Category
Security
Occurrences
18
Severity
warning

Sample message

Complex placeholders used for values in the query string in $wpdb->prepare() will NOT be quoted automagically. Found: %1s.

WARNINGSecurityInput is not validated17
Category
Security
Occurrences
17
Severity
warning

Sample message

Detected usage of a possibly undefined superglobal array index: $_SERVER['HTTP_HOST']. Check that the array index exists before using it.

ERRORMaintainabilityrand mt rand17
Category
Maintainability
Occurrences
17
Severity
error

Sample message

mt_rand() is discouraged. Use the far less predictable wp_rand() instead.

WARNINGSecurityNonce verification recommended16
Category
Security
Occurrences
16
Severity
warning

Sample message

Processing form data without nonce verification.

ERRORI18nUnordered Placeholders Text16
Category
I18n
Occurrences
16
Severity
error

Sample message

Multiple placeholders in translatable strings should be ordered. Expected "%1$s, %2$d", but got "%s, %d" in 'Maximum value for %s is %d'.

ERRORI18nNon Singular String Literal Text12
Category
I18n
Occurrences
12
Severity
error

Sample message

The $text parameter must be a single text string literal. Found: $configOptions[$key]['description']

ERRORMaintainabilitydate date11
Category
Maintainability
Occurrences
11
Severity
error

Sample message

date() is affected by runtime timezone changes which can cause date/time to be incorrectly displayed. Use gmdate() instead.

WARNINGSecurityMissing nonce verification9
Category
Security
Occurrences
9
Severity
warning

Sample message

Processing form data without nonce verification.

ERRORMaintainabilityfile system operations fread9
Category
Maintainability
Occurrences
9
Severity
error

Sample message

File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fread().

ERRORMaintainabilityfile system operations mkdir4
Category
Maintainability
Occurrences
4
Severity
error

Sample message

File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: mkdir().

External Connections

Not analyzed yet.

Score History

First score snapshot

v1.8.1

24

Latest

Findings
2,546
Errors
1,913
Warnings
633
Check
2.0.0

Relationship Map

Author, categories, issues, domains, and nearby plugins.

29 nodes

Related Plugins

Contact Form Query

1k+ active installs

100
Style Contact Form 7

1k+ active installs

100
ACF Field For CF7

10k+ active installs

99