Create voting and upload galleries for photos, video, audio and files. Gallery monetization, social sharing and user registration.
23
Score
9,584
Errors
27,731
Warnings
+0
Change
Category Scores
Security0
Repo85
Performance98
Maintainability0
Issues to Review
Prioritized issue groups from the latest Plugin Check scan
Maintainability
23,055
11 issue groups
Security
11,526
11 issue groups
I18n
2,209
3 issue groups
WARNINGMaintainabilityNon-prefixed global variableGlobal variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$ActivateBulkUpload".17,052
- Category
- Maintainability
- Occurrences
- 17,052
- Severity
- warning
Sample message
Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$ActivateBulkUpload".
ERRORSecurityHeredoc Output Not EscapedAll output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found interpolation in unescaped heredoc.2,621
- Category
- Security
- Occurrences
- 2,621
- Severity
- error
Sample message
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found interpolation in unescaped heredoc.
WARNINGSecurityInterpolated SQL is not preparedUse placeholders and $wpdb->prepare(); found interpolated variable $AdditionalFilesMainRealId at "SELECT MultipleFiles FROM $tablename1 WHERE id = '$AdditionalFilesMainRealId'"2,151
- Category
- Security
- Occurrences
- 2,151
- Severity
- warning
Sample message
Use placeholders and $wpdb->prepare(); found interpolated variable $AdditionalFilesMainRealId at "SELECT MultipleFiles FROM $tablename1 WHERE id = '$AdditionalFilesMainRealId'"
ERRORSecurityOutput is not escapedAll output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '" $BorderRadiusClass' data-cg-entry-id='$entryId' data-cg-real-gid='$realGid'>"'.2,121
- Category
- Security
- Occurrences
- 2,121
- Severity
- error
Sample message
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '" $BorderRadiusClass' data-cg-entry-id='$entryId' data-cg-real-gid='$realGid'>"'.
WARNINGMaintainabilityDirect QueryUse of a direct database call is discouraged.1,510
- Category
- Maintainability
- Occurrences
- 1,510
- Severity
- warning
Sample message
Use of a direct database call is discouraged.
WARNINGMaintainabilityNo CachingDirect database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().1,498
- Category
- Maintainability
- Occurrences
- 1,498
- Severity
- warning
Sample message
Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().
WARNINGSecurityMissing nonce verificationProcessing form data without nonce verification.1,141
- Category
- Security
- Occurrences
- 1,141
- Severity
- warning
Sample message
Processing form data without nonce verification.
ERRORMaintainabilityNot AllowedUse of heredoc syntax (<<<) is not allowed; use standard strings or inline HTML instead1,067
- Category
- Maintainability
- Occurrences
- 1,067
- Severity
- error
Sample message
Use of heredoc syntax (<<<) is not allowed; use standard strings or inline HTML instead
WARNINGSecurityDatabase parameter is not escapedUnescaped parameter $commentsTable used in $wpdb->get_col()\n$commentsTable assigned unsafely at line 629.1,047
- Category
- Security
- Occurrences
- 1,047
- Severity
- warning
Sample message
Unescaped parameter $commentsTable used in $wpdb->get_col()\n$commentsTable assigned unsafely at line 629.
WARNINGMaintainabilityNon-prefixed functionFunctions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "cgDropTables".998
- Category
- Maintainability
- Occurrences
- 998
- Severity
- warning
Sample message
Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "cgDropTables".
Show 15 moreShow less
ERRORI18nNon Singular String Literal Domain942
- Category
- I18n
- Occurrences
- 942
- Severity
- error
Sample message
The $domain parameter must be a single text string literal. Found: $domain
ERRORI18nNon Singular String Literal Text941
- Category
- I18n
- Occurrences
- 941
- Severity
- error
Sample message
The $text parameter must be a single text string literal. Found: $default
WARNINGSecurityRequest data is not unslashed784
- Category
- Security
- Occurrences
- 784
- Severity
- warning
Sample message
$_COOKIE['contest-gal1ery-'.$galeryID.'-voting'] not unslashed before sanitization. Use wp_unslash() or similar
WARNINGSecurityInput is not sanitized651
- Category
- Security
- Occurrences
- 651
- Severity
- warning
Sample message
Detected usage of a non-sanitized input variable: $_COOKIE[$cookieName]
ERRORMaintainabilityMissing direct file access protection407
- Category
- Maintainability
- Occurrences
- 407
- Severity
- error
Sample message
PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;
WARNINGSecurityNonce verification recommended389
- Category
- Security
- Occurrences
- 389
- Severity
- warning
Sample message
Processing form data without nonce verification.
WARNINGSecurityInput is not validated328
- Category
- Security
- Occurrences
- 328
- Severity
- warning
Sample message
Detected usage of a possibly undefined superglobal array index: $_FILES[$filesKey]['error'][0]. Check that the array index exists before using it.
ERRORI18nMissing Arg Domain326
- Category
- I18n
- Occurrences
- 326
- Severity
- error
Sample message
Missing $domain parameter in function call to __().
ERRORSecurityDatabase parameter is not escaped148
- Category
- Security
- Occurrences
- 148
- Severity
- error
Sample message
Unescaped parameter $availableSql used in $wpdb->get_var()\n$availableSql assigned unsafely at line 1163.
ERRORSecuritySQL query is not prepared145
- Category
- Security
- Occurrences
- 145
- Severity
- error
Sample message
Use placeholders and $wpdb->prepare(); found $WhereValues
ERRORMaintainabilityfile system operations fclose132
- Category
- Maintainability
- Occurrences
- 132
- Severity
- error
Sample message
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fclose().
ERRORMaintainabilitydate date110
- Category
- Maintainability
- Occurrences
- 110
- Severity
- error
Sample message
date() is affected by runtime timezone changes which can cause date/time to be incorrectly displayed. Use gmdate() instead.
ERRORMaintainabilityfile system operations fopen110
- Category
- Maintainability
- Occurrences
- 110
- Severity
- error
Sample message
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fopen().
ERRORMaintainabilityunlink unlink86
- Category
- Maintainability
- Occurrences
- 86
- Severity
- error
Sample message
unlink() is discouraged. Use wp_delete_file() to delete a file.
ERRORMaintainabilitycurl curl setopt85
- Category
- Maintainability
- Occurrences
- 85
- Severity
- error
Sample message
Using cURL functions is highly discouraged. Use wp_remote_get() instead.
External Connections
Potential connections found in static code analysis.
Outbound calls
163
External assets
8
Incoming endpoints
101
Notable Domains
contest-gallery.com22 · outbound
stackoverflow.com17 · outbound
api.stripe.com12 · outbound
developer.paypal.com6 · outbound
youtube.com6 · outbound
docs.stripe.com4 · outbound
Platform / Reference Domains
schema.org9 · platform/reference
w3.org4 · platform/reference
codex.wordpress.org1 · platform/reference
developer.wordpress.org1 · platform/reference
github.com1 · platform/reference
make.wordpress.org1 · platform/reference
s.w.org1 · platform/reference
External Asset Domains
google.com9 · asset + outbound
accounts.google.com3 · asset + outbound
code.jquery.com3 · asset
js.stripe.com1 · asset
Incoming Endpoints
/wp-json/contest-gallery-network/v1/verifyREST
register_rest_route
wp_ajax_nopriv_cg_show_set_comments_v10public
wp_ajax
wp_ajax_nopriv_post_cg_changes_recognizedpublic
wp_ajax
wp_ajax_nopriv_post_cg_check_if_onlinepublic
wp_ajax
wp_ajax_nopriv_post_cg_ecommerce_payment_processingpublic
wp_ajax
wp_ajax_nopriv_post_cg_galleries_show_cg_gallerypublic
wp_ajax
Admin AJAX endpoints67
wp_ajax_post_cg1l_get_gallery_dataauthenticated
wp_ajax
admin_post_cg_network_exportauthenticated
admin_post
admin_post_cg_user_data_export_downloadauthenticated
admin_post
wp_ajax_cg_check_wp_admin_upload_v10authenticated
wp_ajax
wp_ajax_cg_show_set_comments_v10authenticated
wp_ajax
wp_ajax_post_cg_add_openai_imageauthenticated
wp_ajax
wp_ajax_post_cg_attach_to_another_userauthenticated
wp_ajax
wp_ajax_post_cg_attach_to_another_user_selectauthenticated
wp_ajax
wp_ajax_post_cg_backend_gallery_user_filter_optionsauthenticated
wp_ajax
wp_ajax_post_cg_backend_image_uploadauthenticated
wp_ajax
wp_ajax_post_cg_change_invoiceauthenticated
wp_ajax
wp_ajax_post_cg_changes_recognizedauthenticated
wp_ajax
55 more hidden
Score History
11 score snapshots
v33.0.3
23
Latest
- Findings
- 37,315
- Errors
- 9,584
- Warnings
- 27,731
- Check
- 2.1.0
v33.0.2
23
Score
- Findings
- 37,389
- Errors
- 9,623
- Warnings
- 27,766
- Check
- 2.1.0
| Scan | Score | Findings | Errors | Warnings | Plugin | Check |
|---|---|---|---|---|---|---|
| Latest | 23 | 37,315 | 9,584 | 27,731 | v33.0.3 | 2.1.0 |
| 23 | 37,389 | 9,623 | 27,766 | v33.0.2 | 2.1.0 |
Relationship Map
Author, categories, issues, domains, and nearby plugins.
Loading map
PluginAuthorCategoryIssueDomainRelated
Relationship links
Issue
Domain
Related
AI Puffer – Chat. Create. Automate. (formerly AI Power)100 scoreContact Form 769 scoreElementor Website Builder – more than just a page builder38 scoreYoast SEO – Advanced SEO with real-time guidance and built-in AI24 scoreLiteSpeed Cache35 scoreWooCommerce22 scoreAkismet Anti-spam: Spam Protection35 scoreWordfence Security – Firewall, Malware Scan, and Login Security21 scoreGutenberg23 scorePage Builder: Pagelayer – Drag and Drop website builder23 scoreJetBackup – Backup, Restore & Migrate10 scoreGutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns24 scoreCrowdsignal Dashboard – Polls, Surveys & more26 scorePixelYourSite – Your smart PIXEL (TAG) & API Manager24 score
Issue
Domain
Related
AI Puffer – Chat. Create. Automate. (formerly AI Power)100 scoreContact Form 769 scoreElementor Website Builder – more than just a page builder38 scoreYoast SEO – Advanced SEO with real-time guidance and built-in AI24 scoreLiteSpeed Cache35 scoreWooCommerce22 scoreAkismet Anti-spam: Spam Protection35 scoreWordfence Security – Firewall, Malware Scan, and Login Security21 scoreGutenberg23 scorePage Builder: Pagelayer – Drag and Drop website builder23 scoreJetBackup – Backup, Restore & Migrate10 scoreGutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns24 scoreCrowdsignal Dashboard – Polls, Surveys & more26 scorePixelYourSite – Your smart PIXEL (TAG) & API Manager24 score
Related Plugins
AI Puffer – Chat. Create. Automate. (formerly AI Power)
10k+ active installs
100
AutoPen – AI Content Writer
3k+ active installs
99
Free Customer Service Tools by OpenWidget
400 active installs
95
ePoll – Contest Poll Survey & Voting
1k+ active installs
89
AI Content Creator – Easy ChatGPT powered article generator
500 active installs
89
HHG for TranslatePress
1k+ active installs
84