JPG, PNG, MP4, MP3, PDF, ZIP & more. Create voting & uploading galleries for photos & media. Social Share, User Registration & Sell via PayPal/Stripe.
23
Score
9,396
Errors
26,680
Warnings
+0
Change
Category Scores
Security0
Repo85
Performance98
Maintainability0
Issues to Review
Prioritized issue groups from the latest Plugin Check scan
Maintainability
22,297
11 issue groups
Security
11,179
11 issue groups
I18n
2,057
3 issue groups
WARNINGMaintainabilityNon-prefixed global variableGlobal variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$ActivateBulkUpload".16,745
- Category
- Maintainability
- Occurrences
- 16,745
- Severity
- warning
Sample message
Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$ActivateBulkUpload".
ERRORSecurityHeredoc Output Not EscapedAll output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found interpolation in unescaped heredoc.2,565
- Category
- Security
- Occurrences
- 2,565
- Severity
- error
Sample message
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found interpolation in unescaped heredoc.
ERRORSecurityOutput is not escapedAll output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '" $BorderRadiusClass' data-cg-entry-id='$entryId' data-cg-real-gid='$realGid'>"'.2,106
- Category
- Security
- Occurrences
- 2,106
- Severity
- error
Sample message
All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '" $BorderRadiusClass' data-cg-entry-id='$entryId' data-cg-real-gid='$realGid'>"'.
WARNINGSecurityInterpolated SQL is not preparedUse placeholders and $wpdb->prepare(); found interpolated variable $AdditionalFilesMainRealId at "SELECT MultipleFiles FROM $tablename1 WHERE id = '$AdditionalFilesMainRealId'"2,040
- Category
- Security
- Occurrences
- 2,040
- Severity
- warning
Sample message
Use placeholders and $wpdb->prepare(); found interpolated variable $AdditionalFilesMainRealId at "SELECT MultipleFiles FROM $tablename1 WHERE id = '$AdditionalFilesMainRealId'"
WARNINGMaintainabilityDirect QueryUse of a direct database call is discouraged.1,356
- Category
- Maintainability
- Occurrences
- 1,356
- Severity
- warning
Sample message
Use of a direct database call is discouraged.
WARNINGMaintainabilityNo CachingDirect database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().1,354
- Category
- Maintainability
- Occurrences
- 1,354
- Severity
- warning
Sample message
Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().
WARNINGSecurityMissing nonce verificationProcessing form data without nonce verification.1,078
- Category
- Security
- Occurrences
- 1,078
- Severity
- warning
Sample message
Processing form data without nonce verification.
ERRORMaintainabilityNot AllowedUse of heredoc syntax (<<<) is not allowed; use standard strings or inline HTML instead1,066
- Category
- Maintainability
- Occurrences
- 1,066
- Severity
- error
Sample message
Use of heredoc syntax (<<<) is not allowed; use standard strings or inline HTML instead
WARNINGSecurityDatabase parameter is not escapedUnescaped parameter $contest_gal1ery_create_user_entries used in $wpdb->query()\n$contest_gal1ery_create_user_entries assigned unsafely at line 157.990
- Category
- Security
- Occurrences
- 990
- Severity
- warning
Sample message
Unescaped parameter $contest_gal1ery_create_user_entries used in $wpdb->query()\n$contest_gal1ery_create_user_entries assigned unsafely at line 157.
ERRORI18nNon Singular String Literal DomainThe $domain parameter must be a single text string literal. Found: $domain876
- Category
- I18n
- Occurrences
- 876
- Severity
- error
Sample message
The $domain parameter must be a single text string literal. Found: $domain
Show 15 moreShow less
ERRORI18nNon Singular String Literal Text876
- Category
- I18n
- Occurrences
- 876
- Severity
- error
Sample message
The $text parameter must be a single text string literal. Found: $l_Account
WARNINGMaintainabilityNon-prefixed function819
- Category
- Maintainability
- Occurrences
- 819
- Severity
- warning
Sample message
Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "cgDropTables".
WARNINGSecurityRequest data is not unslashed783
- Category
- Security
- Occurrences
- 783
- Severity
- warning
Sample message
$_COOKIE['contest-gal1ery-'.$galeryID.'-voting'] not unslashed before sanitization. Use wp_unslash() or similar
WARNINGSecurityInput is not sanitized646
- Category
- Security
- Occurrences
- 646
- Severity
- warning
Sample message
Detected usage of a non-sanitized input variable: $_COOKIE[$cookieName]
ERRORMaintainabilityMissing direct file access protection414
- Category
- Maintainability
- Occurrences
- 414
- Severity
- error
Sample message
PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;
WARNINGSecurityNonce verification recommended356
- Category
- Security
- Occurrences
- 356
- Severity
- warning
Sample message
Processing form data without nonce verification.
WARNINGSecurityInput is not validated347
- Category
- Security
- Occurrences
- 347
- Severity
- warning
Sample message
Detected usage of a possibly undefined superglobal array index: $_FILES[$filesKey]['error'][0]. Check that the array index exists before using it.
ERRORI18nMissing Arg Domain305
- Category
- I18n
- Occurrences
- 305
- Severity
- error
Sample message
Missing $domain parameter in function call to __().
ERRORSecuritySQL query is not prepared136
- Category
- Security
- Occurrences
- 136
- Severity
- error
Sample message
Use placeholders and $wpdb->prepare(); found $WhereValues
ERRORMaintainabilityfile system operations fclose133
- Category
- Maintainability
- Occurrences
- 133
- Severity
- error
Sample message
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fclose().
ERRORSecurityDatabase parameter is not escaped132
- Category
- Security
- Occurrences
- 132
- Severity
- error
Sample message
Unescaped parameter $categoriesSumString used in $wpdb->get_results()\n$categoriesSumString assigned unsafely at line 194.
ERRORMaintainabilityfile system operations fopen111
- Category
- Maintainability
- Occurrences
- 111
- Severity
- error
Sample message
File operations should use WP_Filesystem methods instead of direct PHP filesystem calls. Found: fopen().
ERRORMaintainabilitydate date110
- Category
- Maintainability
- Occurrences
- 110
- Severity
- error
Sample message
date() is affected by runtime timezone changes which can cause date/time to be incorrectly displayed. Use gmdate() instead.
ERRORMaintainabilitycurl curl setopt105
- Category
- Maintainability
- Occurrences
- 105
- Severity
- error
Sample message
Using cURL functions is highly discouraged. Use wp_remote_get() instead.
ERRORMaintainabilityunlink unlink84
- Category
- Maintainability
- Occurrences
- 84
- Severity
- error
Sample message
unlink() is discouraged. Use wp_delete_file() to delete a file.
External Connections
Potential connections found in static code analysis.
Outbound calls
179
External assets
8
Incoming endpoints
101
Notable Domains
contest-gallery.com25 · outbound
stackoverflow.com17 · outbound
api.stripe.com12 · outbound
youtube.com10 · outbound
platform.openai.com7 · outbound
developer.paypal.com6 · outbound
Platform / Reference Domains
schema.org9 · platform/reference
w3.org4 · platform/reference
codex.wordpress.org1 · platform/reference
developer.wordpress.org1 · platform/reference
github.com1 · platform/reference
make.wordpress.org1 · platform/reference
s.w.org1 · platform/reference
External Asset Domains
google.com9 · asset + outbound
accounts.google.com3 · asset + outbound
code.jquery.com3 · asset
js.stripe.com1 · asset
Incoming Endpoints
/wp-json/contest-gallery-network/v1/verifyREST
register_rest_route
wp_ajax_nopriv_cg_show_set_comments_v10public
wp_ajax
wp_ajax_nopriv_post_cg_changes_recognizedpublic
wp_ajax
wp_ajax_nopriv_post_cg_check_if_onlinepublic
wp_ajax
wp_ajax_nopriv_post_cg_ecommerce_payment_processingpublic
wp_ajax
wp_ajax_nopriv_post_cg_galleries_show_cg_gallerypublic
wp_ajax
Admin AJAX endpoints72
wp_ajax_post_cg1l_get_gallery_dataauthenticated
wp_ajax
admin_post_cg_network_exportauthenticated
admin_post
admin_post_cg_user_data_export_downloadauthenticated
admin_post
wp_ajax_cg_check_wp_admin_upload_v10authenticated
wp_ajax
wp_ajax_cg_show_set_comments_v10authenticated
wp_ajax
wp_ajax_post_cg_add_openai_imageauthenticated
wp_ajax
wp_ajax_post_cg_attach_to_another_userauthenticated
wp_ajax
wp_ajax_post_cg_attach_to_another_user_selectauthenticated
wp_ajax
wp_ajax_post_cg_backend_gallery_user_filter_optionsauthenticated
wp_ajax
wp_ajax_post_cg_backend_image_uploadauthenticated
wp_ajax
wp_ajax_post_cg_change_invoiceauthenticated
wp_ajax
wp_ajax_post_cg_changes_recognizedauthenticated
wp_ajax
60 more hidden
Score History
6 score snapshots
v32.0.0
23
Latest
- Findings
- 36,076
- Errors
- 9,396
- Warnings
- 26,680
- Check
- 2.0.0
v31.0.0
23
Score
- Findings
- 35,788
- Errors
- 9,358
- Warnings
- 26,430
- Check
- 2.0.0
| Scan | Score | Findings | Errors | Warnings | Plugin | Check |
|---|---|---|---|---|---|---|
| Latest | 23 | 36,076 | 9,396 | 26,680 | v32.0.0 | 2.0.0 |
| 23 | 35,788 | 9,358 | 26,430 | v31.0.0 | 2.0.0 |
Relationship Map
Author, categories, issues, domains, and nearby plugins.
Loading map
PluginAuthorCategoryIssueDomainRelated
Relationship links
Issue
Domain
Related
AI Puffer – Chat. Create. Automate. (formerly AI Power)100 scoreContact Form 769 scoreElementor Website Builder – more than just a page builder39 scoreYoast SEO – Advanced SEO with real-time guidance and built-in AI24 scoreLiteSpeed Cache35 scoreWooCommerce21 scoreAkismet Anti-spam: Spam Protection35 scoreWordfence Security – Firewall, Malware Scan, and Login Security21 scorePage Builder: Pagelayer – Drag and Drop website builder24 scoreGutenberg23 scoreJetBackup – Backup, Restore & Migrate10 scoreGutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns24 scoreCrowdsignal Dashboard – Polls, Surveys & more26 scoreAI Engine – The Chatbot, AI Framework & MCP for WordPress23 score
Issue
Domain
Related
AI Puffer – Chat. Create. Automate. (formerly AI Power)100 scoreContact Form 769 scoreElementor Website Builder – more than just a page builder39 scoreYoast SEO – Advanced SEO with real-time guidance and built-in AI24 scoreLiteSpeed Cache35 scoreWooCommerce21 scoreAkismet Anti-spam: Spam Protection35 scoreWordfence Security – Firewall, Malware Scan, and Login Security21 scorePage Builder: Pagelayer – Drag and Drop website builder24 scoreGutenberg23 scoreJetBackup – Backup, Restore & Migrate10 scoreGutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns24 scoreCrowdsignal Dashboard – Polls, Surveys & more26 scoreAI Engine – The Chatbot, AI Framework & MCP for WordPress23 score
Related Plugins
AI Puffer – Chat. Create. Automate. (formerly AI Power)
10k+ active installs
100
AutoPen – AI Content Writer
1k+ active installs
99
Free Customer Service Tools by OpenWidget
400 active installs
95
ePoll – Contest Poll Survey & Voting
1k+ active installs
89
AI Content Creator – Easy ChatGPT powered article generator
500 active installs
89
HHG for TranslatePress
900 active installs
84